24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fragtor.Generic Sample 42c24e5ea82d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 42c24e5ea82d…. Malware family: Fragtor.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d","keywords":["Malicious","Fragtor.Generic","malware analysis","sandbox report","threat intelligence","42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fragtor.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8bc,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "Timer: QueryPerformanceFrequency failed with error" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "Timer: QueryPerformanceCounter failed with error" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")26:T458,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")27:T404,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp, 00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp, 00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")28:T13f1,Found reference to "HMAC(" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to "PBKDF2_HMAC(" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to "HKDF(" (Indicator: "HKDF"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to "RandomNumberGenerator: IncorporateEntropy not implemented" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to "HMAC: can only be used with a block-based hash function" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to ".?AVAesEncryptionError@@" (Indicator: "Aes"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AVBase@Rijndael@CryptoPP@@" (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@VHMAC_Base@CryptoPP@@V?$HMAC@VSHA256@CryptoPP@@@2@@CryptoPP@@V?$HMAC@VSHA256@CryptoPP@@@2@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$SimpleKeyingInterfaceImpl@VHMAC_Base@CryptoPP@@V?$HMAC@VSHA256@CryptoPP@@@2@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$ClonableImpl@VSHA512@CryptoPP@@V?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Decryption@2@@CryptoPP@@" (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$BlockCipherFinal@$0A@VEnc@Rijndael@CryptoPP@@@CryptoPP@@" (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@VHMAC_Base@CryptoPP@@V?$HMAC@VSHA512@CryptoPP@@@2@@CryptoPP@@V?$HMAC@VSHA512@CryptoPP@@@2@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@VHMAC_Base@CryptoPP@@V?$HMAC@VSHA512@CryptoPP@@@2@@CryptoPP@@V?$HMAC@VSHA512@CryptoPP@@@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") file/memory contains long string with (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$PKCS5_PBKDF2_HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$PKCS5_PBKDF2_HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AVSHA512@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$HKDF@VSHA256@CryptoPP@@@CryptoPP@@" (Indicator: "HKDF"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA256@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$_Ref_count@V?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Decryption@2@@CryptoPP@@@std@@" (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$MessageAuthenticationCodeImpl@VHMAC_Base@CryptoPP@@V?$HMAC@VSHA256@CryptoPP@@@2@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AURijndael_Info@CryptoPP@@" (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@" (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$IteratedHashWithStaticTransform@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@$0EA@VSHA512@2@$0EA@$00@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found reference to ".?AV?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@" (Indicator: "Rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp")29:T414,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Found Base64 decoding crypto library string in memory Matched sigs: Found Base64 encoding crypto library string in memory Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains ability to perform AES encryption using crypto++ library Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption2a:T53a,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")2b:Tabe,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000a2740000ed00000000002d6ea27440c9a7f111000000181aab7260d53b00000000006002ed007f0000007f00000080000000a0d43b000000000024d53b0070c8a374646c3485feffffff11000000503cac720e000000f4d43b00856aa4741c23a97434d53b00f85fa47408000000bb69a374b269a374a8c8a7f111000000181aab720e000000503cac7208d53b0011000000503cac720e00000038d53b00856aa4741c23a97480d53b00b90eac723614ac72ae0eac72f984432d11000000181aab720e000000503cac72e859ed00b059ed00f984432d48d53b000a5eab7234d63b004014ac7221f3d55ffeffffffae0eac72c80eac72503cac72b0d53b00 (UID: 00000000-00001644)2c:T443,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")2d:T64d,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00001644)2e:T21ee,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001644) "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001644)2f:T19b6,"SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "select*from"%w".%s where %s order by rowid") "SELECT 1 FROM "%w".%s WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d)=NULL" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "select 1 from "%w".%s where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d)=null"), "SELECT 1 FROM temp.%s WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1)=NULL" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "select 1 from temp.%s where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1)=null"), "UPDATE "%w".%s SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update "%w".%s set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.%s SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update %q.%s set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update sqlite_temp_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1) then %q else tbl_name end where type in ('view', 'trigger')"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE "%w".%s SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q) AND sql NOT LIKE 'create virtual%%'" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update "%w".%s set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q) and sql not like 'create virtual%%'"), "UPDATE temp.%s SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update temp.%s set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "CREATE TABLE %Q.%s(%s)" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "delete from %q.%s where %s=%q"), "SELECT tbl idx stat FROM %Q.sqlite_stat1" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "select tbl idx stat from %q.sqlite_stat1"), "CREATE TABLE" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "create table"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE %Q.sqlite_sequence(name,seq)" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "create table %q.sqlite_sequence(name,seq)"), "UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "update %q.%s set rootpage=%d where #%d and rootpage=#%d"), "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "delete from %q.sqlite_sequence where name=%q"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q AND type='index'" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q and type='index'"), "CREATE TABLE x" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "create table x"), "CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "create table x(type text,name text,tbl_name text,rootpage int,sql text)"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "select*from"%w".%s order by rowid"), "INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')" (Source: 00000000-00001644.00000000.143969.01132000.00000002.mdmp, Indicator: "insert into %q.%s values('trigger',%q,%q,0,'create trigger %q')")30:T4d6,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")31:T9aaf,Found reference to API (Indicator: "RegOpenKeyExA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "RegCreateKeyExA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "RegSetValueExA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetTokenInformation"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "RegCloseKey"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "OpenProcessToken"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CryptReleaseContext"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetProcessHeap"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetModuleFileNameA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LockFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "VerSetConditionMask"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateEventA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetSystemInfo"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFileAttributesW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapCreate"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "ResetEvent"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FormatMessageW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFileSizeEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetStartupInfoW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFullPathNameW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "lstrcpyA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateFileMappingW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapCompact"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "InitializeSListHead"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateEventW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateDirectoryW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "IsValidLocale"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "ExitThread"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateMutexW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "VirtualQuery"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "WriteConsoleW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "RaiseException"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapFree"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetLastError"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetStdHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetCurrentThreadId"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetEndOfFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LoadLibraryExW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetFilePointerEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LoadLibraryW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FlushFileBuffers"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "WriteConsoleA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "lstrcpynA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LockFileEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "TlsGetValue"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "IsValidCodePage"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CloseHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateThread"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "Thread32First"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "WriteProcessMemory"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetTempPathA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFileAttributesExW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnumResourceNamesW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetProcAddress"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "InitializeCriticalSection"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnumResourceNamesA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "MapViewOfFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetConsoleCP"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetFileAttributesA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "Sleep"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CompareStringW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetStartupInfoA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetLocaleInfoA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "DecodePointer"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapDestroy"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LeaveCriticalSection"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "VirtualProtect"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetOEMCP"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnumResourceTypesA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateFileA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "InterlockedIncrement"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FormatMessageA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFileType"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetThreadLocale"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "AreFileApisANSI"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetHandleCount"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "ReadFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "OutputDebugStringA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFileAttributesA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetModuleHandleExW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetCurrentProcess"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "VirtualFree"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FindResourceExW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFileSize"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "WideCharToMultiByte"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FindClose"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetSystemTime"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LCMapStringA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "TlsSetValue"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "DeleteFileW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "MultiByteToWideChar"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetConsoleMode"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "ReadConsoleW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "OutputDebugStringW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetCurrentProcessId"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetStringTypeA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateMutexA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetBinaryTypeA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "UnlockFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "UnmapViewOfFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetStdHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapAlloc"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetModuleHandleExA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "TlsAlloc"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EncodePointer"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetCommandLineA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "DeleteFileA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "VirtualAlloc"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "ExitProcess"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FreeLibrary"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LCMapStringW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetTempPathW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetFilePointer"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FlushViewOfFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetThreadTimes"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "UnlockFileEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GlobalFree"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LocalFree"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "InterlockedDecrement"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "lstrcatA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnumResourceLanguagesW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetCPInfo"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetLocaleInfoW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "Thread32Next"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetACP"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LoadLibraryA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnterCriticalSection"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "QueryFullProcessImageNameA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetModuleHandleA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "TlsFree"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetCurrentThread"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "OpenThread"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "WaitForSingleObject"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetStringTypeW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "lstrlenA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GlobalAlloc"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FindNextFileW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetFullPathNameA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetTickCount"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "ResumeThread"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FindFirstFileW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CreateFileW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapReAlloc"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "IsDebuggerPresent"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "RtlUnwind"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "TerminateProcess"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FindResourceExA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetCommandLineW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LCMapStringEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetModuleHandleW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapValidate"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SuspendThread"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "HeapSize"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SetEvent"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "DeleteCriticalSection"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FindFirstFileExW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "WriteFile"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetModuleFileNameW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "LoadResource"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "GetLastError"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "EnumResourceTypesW"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "SHGetFolderPathA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "ShellExecuteA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CharNextA"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CoUninitialize"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CoInitializeEx"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "CoCreateInstance"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00001644.00000000.143969.00FE1000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00001644.00000000.143969.00FE1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp, 00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp, 00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp, 00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp, 00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001644.00000000.143969.01167000.00000020.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00001644.00000000.143969.052F0000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001644.00000000.143969.052F0000.00000004.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; Source: "00000000-00001644.00000000.143969.052F0000.00000004.mdmp") Found reference to API (Indicator: "NtProtectVirtualMemory"; Source: "00000000-00001644.00000000.143969.052F0000.00000004.mdmp")32:T9d8,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77050000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77050000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77050000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "KERNEL32" at base 77480000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 77050000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77050000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77050000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77050000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "WINHTTP.DLL" at base 72ff0000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "WININET.DLL" at base 72d20000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a20000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 72c10000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "RPCRT4.DLL" at base 77330000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "KERNEL32.DLL" at base 77480000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72d00000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73220000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "SSPICLI.DLL" at base 73f70000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72c70000 "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7748000033:T648,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")34:Tbe7,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2025"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")35:T69d,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll"36:T6f6,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\WINHTTP.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\WINHTTP.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\WININET.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\wininet.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\WEBIO.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\webio.dll" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" trying to access non-existent file "C:\winnlsres.dll"37:T634,Found URL "http://127.0.0.1:9050" - Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found URL "http://195.20.16.45/api/bing_release.phpredssp.dll27.0.0.127.0.0.1pmapperpmapperpmappersasspirpcegotiatechannelpmappererberospmapperpmappersasspirpcpmappersystemroot%\system32\pnrpnsp.dllhyper-v" - Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found URL "http://www105.147.130/77.105.147.130ecurity=impersonation" - Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found URL "https://ipinfo.io/https://ipgeolocation.io/postnwpkiwciw" - Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllrankreindexedescapeacheckeybeforeignoregexplainsteaddatabaselectablefthendeferrablelsexcludeletemporaryisnullsavepointersectiesnotnullikexceptransactionaturalteraisexclusivexistsconstraintoffsetriggereferencesuniquerywithoutereleaseattachavinglobeginnerangebetweenothingroupscascadetachcasecollatecreatecurrent_dateimmediatejoinsertmatchplanalyzepragmabortupdatevaluesvirtualastwhenwherecursiveafterenameandefaultautoincrementcastcolumncommitconflictcrosscurrent_timestampartitiondeferredistinctdroprecedingfailimitfiltereplacefirstfollowingfromfulliforderestrictothersoverightrollbackrowsunboundedunionusingvacuumviewindowbyinitiallyprimaryonoffalseyestruextrafullnth_value!5ng':)xc!ed" - Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")38:T1285,Found string "AESNI" (Indicator: "aes"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found string ".?AVAesEncryptionError@@" (Indicator: "aes"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AVBase@Rijndael@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AVBase64Decoder@CryptoPP@@" (Indicator: "base64"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Decryption@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$BlockCipherFinal@$0A@VEnc@Rijndael@CryptoPP@@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") file/memory contains long string with (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$_Ref_count@V?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Decryption@2@@CryptoPP@@@std@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AURijndael_Info@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AVBase64Encoder@CryptoPP@@" (Indicator: "base64"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$ClonableImpl@V?$BlockCipherFinal@$0A@VEnc@Rijndael@CryptoPP@@@CryptoPP@@VEnc@Rijndael@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$_Ref_count@V?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$0A@VEnc@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Encryption@2@@CryptoPP@@@std@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$ObjectHolder@V?$BlockCipherFinal@$0A@VEnc@Rijndael@CryptoPP@@@CryptoPP@@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AVDec@Rijndael@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$ObjectHolder@V?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$0A@VEnc@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Encryption@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$AlgorithmImpl@VCBC_Encryption@CryptoPP@@V?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$0A@VEnc@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Encryption@2@@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AVEnc@Rijndael@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$ClonableImpl@V?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@VDec@Rijndael@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$BlockCipherImpl@URijndael_Info@CryptoPP@@VBlockCipher@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp") Found string ".?AV?$AlgorithmImpl@VCBC_Decryption@CryptoPP@@V?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$00VDec@Rijndael@CryptoPP@@@CryptoPP@@VCBC_Decryption@2@@2@@CryptoPP@@" (Indicator: "rijndael"; Source: "00000000-00001644.00000000.143969.0115E000.00000004.mdmp")39:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001644.00000000.143969.00600000.00000004.mdmp")3a:T715,Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")3b:T9b2,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001644.00000000.143969.01132000.00000002.mdmp")3c:Td11,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")3d:T2c76,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\WINDOWSUPDATE"; Key: "DISABLEWINDOWSUPDATEACCESS"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\WINDOWSUPDATE"; Key: "DISABLEWINDOWSUPDATEACCESSMODE"; Value: "00000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}USER\SOFTWARE\POLICIES\MICROSOFT\MICROSOFTEDGE\PHISHINGFILTER"; Key: "ENABLEDV9"; Value: "00000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}USER\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "NOAUSHUTDOWNOPTION"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\APPHVSI"; Key: "ALLOWAPPHVSI_PROVIDERSET"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "ENABLESMARTSCREEN"; Value: "00000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "**DEL.SHELLSMARTSCREENLEVEL"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWS SEARCH"; Key: "ALLOWCORTANA"; Value: "00000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWS SEARCH"; Key: "**DEL.ALLOWCLOUDSEARCH"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE"; Key: "DONOTCONNECTTOWINDOWSUPDATEINTERNETLOCATIONS"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE"; Key: "SETDISABLEUXWUACCESS"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE"; Key: "MANAGEPREVIEWBUILDS"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE"; Key: "MANAGEPREVIEWBUILDSPOLICYVALUE"; Value: "00000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE"; Key: "SETAUTORESTARTNOTIFICATIONDISABLE"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "NOAUTOUPDATE"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.AUOPTIONS"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.AUTOMATICMAINTENANCEENABLED"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.SCHEDULEDINSTALLDAY"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.SCHEDULEDINSTALLTIME"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.SCHEDULEDINSTALLEVERYWEEK"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.SCHEDULEDINSTALLFIRSTWEEK"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.SCHEDULEDINSTALLSECONDWEEK"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.SCHEDULEDINSTALLTHIRDWEEK"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.SCHEDULEDINSTALLFOURTHWEEK"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\AU"; Key: "**DEL.ALLOWMUUPDATESERVICE"; Value: "20000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEANTISPYWARE"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS"; Key: "EXCLUSIONS_EXTENSIONS"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\EXTENSIONS"; Key: "EXE"; Value: "00000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLEROUTINELYTAKINGACTION"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLERAWWRITENOTIFICATION"; Value: "01000000")3e:T623,"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "01000000")3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAZwAAAAAAAAAAAAAAAAAAAGcAAAAAAAAAAAAAAAAAAAAAAAAAAAAGcAAAAAAAAAAAAAAAAAAAB3cAAAAAAAAAAAcAAAAAAAd3AAAAAAAAAAAnAAAAAAAAYAAAAAAAAAAAZwAAAAAAB3cAAAAAAAAAACcAAAAAAHeHAAAAAAAAAAAGcAAAAAAHhwAAAAAAAAAAAHAAAAAAB3cAAAAAAAB3AAdwAAAAAAAHAAAAAAAAAAAHdwAAAAAAAHAAAAAAAAAAB3dwAAAAAAAAAAAAAAAAAAd3dwAAAAAAAAAAAAAAdwAHd3dwAAAAAAAAAAAAABUAB3d3d3AAAAAAAAAAAAAAAAd3d3cAAAAAAAAAAAAAAAAHd3d3dwAAAAAAAAAAAAAAB3d3d3cAAAAAAAAAAAAAAAd3d3d3AAAAAAAAAAAAdwAHd3d3d3AAAAAAAAAAAHcAB3d3dwdwAAAAAAAAAAAAAAd3d3d3cAAAAAAAAAAAAAAHd3d3d3AAAAAAAAAAAAAAB3d3d3d3AAAAAAAAAAAAAAd3d3cHdwAAAAAAAAAAAAAHd3d3F3cAAAAAAAAAAAAAB3d3dwZ3YAAAAAAAAAAAAAB3d3dmd3DgAAAAAAAAAAZid3d3dxdwAAAAAAAAAAcAZmd3d3dwcwAAAAAAAAAHAAAHd3d3AAAAAAAAD4AAAfgAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAH+AAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAD/4AAH/+AAf/w==40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAZwAAAAAAAAAAAAAAAAAAAGcAAAAAAAAAAAAAAAAAAAAAAAAAAAAGcAAAAAAAAAAAAAAAAAAAB3cAAAAAAAAAAAcAAAAAAAd3AAAAAAAAAAAnAAAAAAAAYAAAAAAAAAAAZwAAAAAAB3cAAAAAAAAAACcAAAAAAHeHAAAAAAAAAAAGcAAAAAAHhwAAAAAAAAAAAHAAAAAAB3cAAAAAAAB3AAdwAAAAAAAHAAAAAAAAAAAHdwAAAAAAAHAAAAAAAAAAB3dwAAAAAAAAAAAAAAAAAAd3dwAAAAAAAAAAAAAAdwAHd3dwAAAAAAAAAAAAABUAB3d3d3AAAAAAAAAAAAAAAAd3d3cAAAAAAAAAAAAAAAAHd3d3dwAAAAAAAAAAAAAAB3d3d3cAAAAAAAAAAAAAAAd3d3d3AAAAAAAAAAAAdwAHd3d3d3AAAAAAAAAAAHcAB3d3dwdwAAAAAAAAAAAAAAd3d3d3cAAAAAAAAAAAAAAHd3d3d3AAAAAAAAAAAAAAB3d3d3d3AAAAAAAAAAAAAAd3d3cHdwAAAAAAAAAAAAAHd3d3F3cAAAAAAAAAAAAAB3d3dwZ3YAAAAAAAAAAAAAB3d3dmd3DgAAAAAAAAAAZid3d3dxdwAAAAAAAAAAcAZmd3d3dwcwAAAAAAAAAHAAAHd3d3AAAAAAAAD4AAAfgAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAH+AAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAD/4AAH/+AAf/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790995620232,"unified_at":"2026-10-03T02:47:00.232Z","metadata":{"hashes":{"sha256":"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d","sha1":"74576503141f26edab05ce2da89b66cb3bcf293b","md5":"d08e21ef739bcb9d74508790a6e6238f","sha512":"6ea1cd13b0bda1b69d0af26f073e2eb1eb2722b83a39c4b53148528fb88e09133ef7d095dc6617c5571e4a5248e0162f68afe13a4b1daa522797912a69b5dbee","ssdeep":"98304:eImo/NRpwP2DkKA+Ga5q73V41AmcR1Miq465iU7Fem+KOd8PbXLgKiOvG6ZB6Q3H:Xm0Rouq61i1U5Um+J+jkjEG6Zw","ssdeep_chunks":["98304:eImo/NR","98304:Imo/NRp","98304:mo/NRpw","98304:o/NRpwP","98304:/NRpwP2","98304:NRpwP2D","98304:RpwP2Dk","98304:pwP2DkK","98304:wP2DkKA","98304:P2DkKA+","98304:2DkKA+G","98304:DkKA+Ga","98304:kKA+Ga5","98304:KA+Ga5q","98304:A+Ga5q7","98304:+Ga5q73","98304:Ga5q73V","98304:a5q73V4","98304:5q73V41","98304:q73V41A","98304:73V41Am","98304:3V41Amc","98304:V41AmcR","98304:41AmcR1","98304:1AmcR1M","98304:AmcR1Mi","98304:mcR1Miq","98304:cR1Miq4","98304:R1Miq46","98304:1Miq465","98304:Miq465i","98304:iq465iU","98304:q465iU7","98304:465iU7F","98304:65iU7Fe","98304:5iU7Fem","98304:iU7Fem+","98304:U7Fem+K","98304:7Fem+KO","98304:Fem+KOd","98304:em+KOd8","98304:m+KOd8P","98304:+KOd8Pb","98304:KOd8PbX","98304:Od8PbXL","98304:d8PbXLg","98304:8PbXLgK","98304:PbXLgKi","98304:bXLgKiO","98304:XLgKiOv","98304:LgKiOvG","98304:gKiOvG6","98304:KiOvG6Z","98304:iOvG6ZB","98304:OvG6ZB6","98304:vG6ZB6Q","98304:G6ZB6Q3","98304:6ZB6Q3H","196608:eImo/NR","196608:Imo/NRp","196608:mo/NRpw","196608:o/NRpwP","196608:/NRpwP2","196608:NRpwP2D","196608:RpwP2Dk","196608:pwP2DkK","196608:wP2DkKA","196608:P2DkKA+","196608:2DkKA+G","196608:DkKA+Ga","196608:kKA+Ga5","196608:KA+Ga5q","196608:A+Ga5q7","196608:+Ga5q73","196608:Ga5q73V","196608:a5q73V4","196608:5q73V41","196608:q73V41A","196608:73V41Am","196608:3V41Amc","196608:V41AmcR","196608:41AmcR1","196608:1AmcR1M","196608:AmcR1Mi","196608:mcR1Miq","196608:cR1Miq4","196608:R1Miq46","196608:1Miq465","196608:Miq465i","196608:iq465iU","196608:q465iU7","196608:465iU7F","196608:65iU7Fe","196608:5iU7Fem","196608:iU7Fem+","196608:U7Fem+K","196608:7Fem+KO","196608:Fem+KOd","196608:em+KOd8","196608:m+KOd8P","196608:+KOd8Pb","196608:KOd8PbX","196608:Od8PbXL","196608:d8PbXLg","196608:8PbXLgK","196608:PbXLgKi","196608:bXLgKiO","196608:XLgKiOv","196608:LgKiOvG","196608:gKiOvG6","196608:KiOvG6Z","196608:iOvG6ZB","196608:OvG6ZB6","196608:vG6ZB6Q","196608:G6ZB6Q3","196608:6ZB6Q3H","98304:Xm0Rouq","98304:m0Rouq6","98304:0Rouq61","98304:Rouq61i","98304:ouq61i1","98304:uq61i1U","98304:q61i1U5","98304:61i1U5U","98304:1i1U5Um","98304:i1U5Um+","98304:1U5Um+J","98304:U5Um+J+","98304:5Um+J+j","98304:Um+J+jk","98304:m+J+jkj","98304:+J+jkjE","98304:J+jkjEG","98304:+jkjEG6","98304:jkjEG6Z","98304:kjEG6Zw"],"imphash":"930dd563daeb0071b0a2e064c8e3b25f"},"file_info":{"file_name":"file.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5914112,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1707128122000,"last_seen":1752997980000,"last_multi_scan":1752997980000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":129,"suspicious_count":6,"malicious_count":6,"total":141},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win.SuspiciousDomain","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.VMProtect","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Redcap.cljin","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.499468","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.499468 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.VMProtect.BC suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.02210601","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059f2081 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Trojan.mma","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.RWUD-6253","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanPSW.RisePro","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_36.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.PrivateLoader.Win32.19","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Fragtor.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"malicious","value":"Modifies Windows Auto-Updates feature"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Privilege Escalation","technique":"Group Policy Modification","attack_id":"T1484.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1484/001","identifiers":[{"type":"malicious","value":"Modifies Group policy settings registry keys"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Found Base64 decoding crypto library string in memory"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable Windows defender Anti Spyware"},{"type":"malicious","value":"Tries to disable Windows defender via registry"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Found Base64 encoding crypto library string in memory"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Contains ability to perform AES encryption using crypto++ library"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found Base64 decoding crypto library string in memory","description":"Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00001644.00000000.143969.0115E000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1140","relevance":2,"id":"memorydump-12","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found Base64 encoding crypto library string in memory","description":"Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00001644.00000000.143969.0115E000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1132.001","relevance":2,"id":"memorydump-11","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00002476]\n Process \"WerFault.exe\" [UID: 00000000-00003792]\n Process \"WerFault.exe\" [UID: 00000000-00002400]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".vmp\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor cl\n 8Dh in Stream UID: 140-29926-00C9E13D\n Assembly shows XOR instruction xor si\n 5FA1h in Stream UID: 140-30731-00CBBA42\n Assembly shows XOR instruction xor al\n byte ptr [edi+esi] in Stream UID: 140-30731-00CBBA42","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES encryption using crypto++ library","description":"Found string \".?AURijndael_Info@CryptoPP@@\" (Indicator: \"AURijndael_Info@CryptoPP@@\"; Source: \"00000000-00001644.00000000.143969.0115E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":1,"id":"string-593","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI\" (Indicator: \"AESNI\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.961656901211647","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$29","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001644)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001644)\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001644)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"IsWow64Process\" with parameter \"1644\" - (UID: 00000000-00001644)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001644.00000000.143969.01167000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001644.00000000.143969.01167000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"LdrFindResource_U\" (Indicator: \"FindResource\"; Source: \"00000000-00001644.00000000.143969.052F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 371242)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00001644.00000000.143969.01167000.00000020.mdmp\n \"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00001644.00000000.143969.01167000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\JeffCrazyWW_11\"\n \"JeffCrazyWW_11\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\" (Indicator: \"user-agent: \"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp, 00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76390000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77330000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" was detected as \"VMProtect\" and name: \"Protector\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" touched \"Group Policy Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{EA502722-A23D-11D1-A7D3-0000F87571E3}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has an executable section named \".text\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has an executable section named \".vmp\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has an writable section named \".data\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has an writable section named \".vmp\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" file has an entrypoint instructions - \"push\tecx,mov\tecx, 0xc707d917,pushfd\t,shr\tecx, cl,jns\t0xc41958,test\tal, 0x64,mov\tecx, 0xb6cb7789,push\tcs,adc\tbyte ptr [ecx + 0x467b7fa1], bh,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".vmp\" is \"0x567000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1502df\" greater than 0x100000\n Virtual size of \".vmp\" is \"0x2bf5e4\" greater than 0x100000\n Virtual size of \".vmp\" is \"0x566ee0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 444 -p 1644 -ip 1644\" (UID: 00000000-00002476)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1644 -s 684\" (UID: 00000000-00003792)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1644 -s 684\" (UID: 00000000-00002400)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 444 -p 1644 -ip 1644\" (UID: 00000000-00002476)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1644 -s 684\" (UID: 00000000-00003792)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1644 -s 684\" (UID: 00000000-00002400)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 1773269)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Registry.pol\" has type \"Group Policy Registry Policy Version=1\"- Location: [%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol]- [targetUID: 00000000-00001644]\n \"gpt.ini\" has type \"ASCII text with CRLF line terminators\"- Location: [%WINDIR%\\System32\\GroupPolicy\\gpt.ini]- [targetUID: 00000000-00001644]\n \"gpt.ini\" has type \"ASCII text with CRLF line terminators\"- Location: [%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini]- [targetUID: 00000000-00001644]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" queries basic process information of the \"C:\\42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (UID: 1644)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001644)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" reads file \"c:\\windows\\syswow64\\grouppolicy\\gpt.ini\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" reads file \"c:\\windows\\system32\\grouppolicy\\gpt.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" touched file \"C:\\Windows\\SysWOW64\\GroupPolicy\\gpt.ini\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" touched file \"C:\\Windows\\System32\\GroupPolicy\\Machine\\Registry.pol\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" touched file \"C:\\Windows\\System32\\GroupPolicy\\gpt.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" trying to access non-existent file \"C:\\42C24E5EA82DB961C718B4EC041202F85DE3CDF6D35DD99D83A753F9A175945D.EXE.LOCAL\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" trying to access non-existent file \"C:\\42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" writes file \"c:\\windows\\syswow64\\grouppolicy\\gpt.ini\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" writes file \"c:\\windows\\system32\\grouppolicy\\machine\\registry.pol\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" writes file \"c:\\windows\\system32\\grouppolicy\\gpt.ini\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" writes file \"%windir%\\syswow64\\grouppolicy\\gpt.ini\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" writes file \"%windir%\\system32\\grouppolicy\\machine\\registry.pol\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" writes file \"%windir%\\system32\\grouppolicy\\gpt.ini\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"63b838\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"65e2c0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"63b838\"\n \"lpReserved\": \"0\"}\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"65e2c0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.4.11.22\"\n \"77.105.147.130\"\n \"195.20.16.45\"\n \"27.0.0.1:9050\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:9050\"\n \"127.0.0.1\"\n \"95.20.16.45\"\n \"7.105.147.130\"\n Potential IP \"195.20.16.45\" found in string \"http://195.20.16.45/api/bing_release.php\"\n \"27.0.0.1\"\n Potential IP \"195.20.16.45\" found in string \"ttp://195.20.16.45/\"\n Potential IP \"77.105.147.130\" found in string \"ttp://77.105.147.130/\"\n \"127.0.0.1:9050\"\n Potential IP \"77.105.147.130\" found in string \"http://77.105.147.130/api/bing_release.php\"\n Potential IP \"195.20.16.45\" found in string \"://195.20.16.45/api/bing_release.php HTTP/1.1\"\n Potential IP \"195.20.16.45\" found in string \"Host: 195.20.16.45\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"~o.mv\"\n Heuristic match: \"tu.ni\"\n Heuristic match: \"4je.kz\"\n Heuristic match: \"8d.sb\"\n Heuristic match: \"vm.am\"\n Heuristic match: \"dv.lu\"\n Pattern match: \"http://127.0.0.1:9050\"\n Pattern match: \"http://195.20.16.45/api/bing_release.php\"\n Pattern match: \"http://www105.147.130/\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Pattern match: \"iplogger.org/1nhum4.js\"\n Pattern match: \"http://77.105.147.130/api/bing_release.php\"\n Pattern match: \"https://www.torproject.org/documentation.html\"\n Pattern match: \"https://ipinfo.io/\"\n Pattern match: \"https://ipgeolocation.io/\"\n Pattern match: \"http://www.winimage.com/zlibdll\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$37","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"://195.20.16.45/api/bing_release.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \"HTTP/1.0 501 Tor is not an HTTP Proxy\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \"HTTP/1.0 501\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://127.0.0.1:9050\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001644\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00001644\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"f-4f28-9ccd-7f6cb6468601@ncalrpc:\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00001644.00000000.143969.01167000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001644.00000000.143969.01167000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001644.00000000.143969.00600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00001644.00000000.143969.00FE1000.00000020.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp, 00000000-00001644.00000000.143969.01167000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has section name .vmp with entropy \"7.9950486077553204\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has resource with unusual entropy \"RT_ICON:7.9627046487993605\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" reads file \"C:\\Windows\\SysWOW64\\GroupPolicy\\gpt.ini\"\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" reads file \"C:\\Windows\\System32\\GroupPolicy\\gpt.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d\" has an entrypoint in section \".vmp\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCreateKeyExA\n RegCloseKey\n OpenProcessToken\n GetModuleFileNameA\n GetSystemInfo\n GetFileAttributesW\n UnhandledExceptionFilter\n GetFileSizeEx\n GetStartupInfoW\n CreateFileMappingW\n CreateDirectoryW\n ExitThread\n LoadLibraryExW\n LoadLibraryW\n CreateThread\n WriteProcessMemory\n GetTempPathA\n GetFileAttributesExW\n GetProcAddress\n MapViewOfFile\n Sleep\n GetStartupInfoA\n VirtualProtect\n CreateFileA\n GetSystemDirectoryA\n OutputDebugStringA\n GetFileAttributesA\n GetModuleHandleExW\n FindResourceExW\n GetFileSize\n DeleteFileW\n OutputDebugStringW\n CreateToolhelp32Snapshot\n GetModuleHandleExA\n GetCommandLineA\n DeleteFileA\n VirtualAlloc\n GetTempPathW\n LoadLibraryA\n GetModuleHandleA\n FindNextFileW\n GetTickCount\n FindFirstFileW\n CreateFileW\n IsDebuggerPresent\n TerminateProcess\n FindResourceExA\n GetCommandLineW\n GetModuleHandleW\n FindFirstFileExW\n WriteFile\n GetModuleFileNameW\n ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://ipinfo.io/\" (Indicator: \"ipinfo.io\"; File: \"00000000-00001644.00000000.143969.01132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender Anti Spyware","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-76","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender via registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-77","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"malicious","category":"System Security","name":"Modifies Group policy settings registry keys","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"ENABLESMARTSCREEN\"; Value: \"00000000\")\n \"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"**DEL.SHELLSMARTSCREENLEVEL\"; Value: \"20000000\")","origin":"Registry Access","mitre_attack_id":"T1484.001","relevance":5,"id":"registry-148","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"level":"malicious","category":"System Security","name":"Modifies Windows Auto-Updates feature","description":"\"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-24","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to disable Windows defender Anti Spyware"},{"detail":"Tries to disable Windows defender via registry"}],"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":29,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":29,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files","Sample Crashed","TOR analysis"],"sandbox_reports":[{"id":"687ca05bd6599a245f0edaeb","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d","analysis_start_time":"2025-07-20T07:53:00+00:00","indicators_count":{"informative":129,"suspicious":16,"malicious":6},"tags":["Extracted Files","Sample Crashed","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}],"processes":[{"pid":1644,"ppid":0,"name":"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe","command_line":"","sha256":"42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d","normalized_path":"C:\\42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d.exe","uid":"00000000-00001644","icon":"$3f"},{"pid":3792,"ppid":1644,"name":"WerFault.exe","command_line":"-u -p 1644 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001644","uid":"00000000-00003792"},{"pid":2400,"ppid":1644,"name":"WerFault.exe","command_line":"-u -p 1644 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001644","uid":"00000000-00002400"},{"pid":2476,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 1644 -ip 1644","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002476","icon":"$40"}],"all_imported_dlls":["win32u.dll","sspicli.dll","bcryptprimitives.dll","shell32.dll","shlwapi.dll","winnsi.dll","wow64.dll","msvcp_win.dll","cryptsp.dll","uxtheme.dll","nsi.dll","wow64win.dll","kernel.appcore.dll","powrprof.dll","imm32.dll","wininet.dll","activeds.dll","framedynos.dll","adsldpc.dll","apphelp.dll","combase.dll","winhttp.dll","clbcatq.dll","mpr.dll","webio.dll","kernel32.dll","cryptbase.dll","ws2_32.dll","fltLib.dll","gpapi.dll","gdi32.dll","gdi32full.dll","ntdsapi.dll","ntdll.dll","OnDemandConnRouteHelper.dll","user32.dll","KernelBase.dll","rpcrt4.dll","cfgmgr32.dll","windows.storage.dll","VxSSL32.dll","gpedit.dll","dssec.dll","authz.dll","mswsock.dll","ucrtbase.dll","advapi32.dll","dsuiext.dll","Wldap32.dll","IPHLPAPI.DLL","wow64cpu.dll","msvcrt.dll","dsrole.dll","ole32.dll","comctl32.dll","SHCore.dll","oleaut32.dll","logoncli.dll","netutils.dll","sechost.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"gpt.ini","sha256":"77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"name":"Registry.pol","sha256":"40322dca674b039c9bdf85b7dc9e50aa9abba625523aa4ac69df3c8d6011e6d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"path":"%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\gpt.ini","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\WINDOWSUPDATE\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\POLICIES\\MICROSOFT\\MICROSOFTEDGE\\PHISHINGFILTER\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\POLICIES\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\POLICIES\\MICROSOFT\\MICROSOFTEDGE\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}USER\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\APPHVSI\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWS SEARCH\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\EXCLUSIONS\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\EXCLUSIONS\\EXTENSIONS\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{004860B8-9362-4192-A512-D1153A5B3F62}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\\","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\JeffCrazyWW_11","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]},{"name":"JeffCrazyWW_11","sources":[{"report_type":"sandbox","report_id":"687ca05bd6599a245f0edaeb"}]}]}},"report_ids":{"sandbox_job_ids":["687ca05bd6599a245f0edaeb"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Fragtor.Generic Sample 42c24e5ea82d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 42c24e5ea82d…. Malware family: Fragtor.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d"}],["$","meta","4",{"property":"og:title","content":"Malicious Fragtor.Generic Sample 42c24e5ea82d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 42c24e5ea82d…. Malware family: Fragtor.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Fragtor.Generic Sample 42c24e5ea82d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 42c24e5ea82d…. Malware family: Fragtor.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]