26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.BlackMatter.Generic Sample 47f8790c9b5b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 47f8790c9b5b…. Malware family: Ransom.BlackMatter.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25","keywords":["Malicious","Ransom.BlackMatter.Generic","malware analysis","sandbox report","threat intelligence","47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25"],"about":{"@type":"SoftwareApplication","name":"loader_domain.exe","applicationCategory":["peexe","executable"],"identifier":"47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.BlackMatter.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta71,"loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3320647579 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3320656523 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325191392 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325199835 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325307551 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325315821 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325330328 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325339023 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325568878 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325579004 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325787270 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3325795248 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326005582 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326014182 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326224318 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326231394 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326443045 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326452006 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326661823 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326668976 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326880497 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3326887599 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3327333741 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3327343337 [PID: 7572] "loader_domain.exe" queried SystemProcessInformation at 00000000-00007572-00000C15-3327552427 [PID: 7572]28:T10a9,"loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft Office Outlook.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft Office Outlook.searchconnector-ms.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft OneNote.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms" to "%USERPROFILE%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\MicrosoftEdgeFavoritesBackup.html" to "%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\MicrosoftEdgeFavoritesBackup.html.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Favorites\Bing.url" to "%USERPROFILE%\Favorites\Bing.url.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\Database1.accdb" to "%USERPROFILE%\Documents\Database1.accdb.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook.pst.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook1.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook1.pst.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\Unfiled Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\Unfiled Notes.one.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent" to "%APPDATA%\Wireshark\recent.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent_common" to "%APPDATA%\Wireshark\recent_common.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\elevate.vbs" to "%APPDATA%\nvm\elevate.vbs.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\settings.txt" to "%APPDATA%\nvm\settings.txt.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\setuserenv.vbs" to "%APPDATA%\nvm\setuserenv.vbs.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\unins000.dat" to "%APPDATA%\nvm\unins000.dat.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\unsetuserenv.vbs" to "%APPDATA%\nvm\unsetuserenv.vbs.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\CHANGELOG.md" to "%APPDATA%\nvm\v20.15.0\CHANGELOG.md.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\corepack" to "%APPDATA%\nvm\v20.15.0\corepack.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\LICENSE" to "%APPDATA%\nvm\v20.15.0\LICENSE.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\npm" to "%APPDATA%\nvm\v20.15.0\npm.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\npx" to "%APPDATA%\nvm\v20.15.0\npx.o7k3OQSE9"29:T82b,Found XOR loop in file "sample.bin" at offset 110908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 148691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 16839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 16989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17920; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18407; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 19063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 122795; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 128878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 148393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 139640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 144990; code bytes = 80302a:Teec,"loader_domain.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000094001a00000078b0930014001a00700a3700640000004f611a755c00000000000000f0ed6f001aa0aa72f4ed6f000bed1a7500009300000000001874940004ee6f00d8ec1a75187494000000000010ee6f0002d8aa721874940074ee6f00b7abaa7218749400030000009e29357790c0940000000000280000002400000000009300e8ee6f006c00000048ef6f001f0000001f00000000003f00d0073700300000005c000000030000000000370067b021e8bc006f00e514ab7201000000d8bf940030b2930003000000000000002000000000003700d0013700ac0b370000000000a80b370040ef6f00e0ee6f0050f5347790c0940048ef6f0094ef6f00 (UID: 00000000-00007572) "loader_domain.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007572) "loader_domain.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007572) "loader_domain.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000b0ee6f0054ee6f00226e667400008b00000000002d6e6674e4767c0e2d000000ecb7ff75d8ee6f0000003700c8fc9400d09c94000c0000008000000018ee6f00000037009cee6f0070c8677448e97f7afeffffff2d000000d0cc0e76270000006cee6f00856a68741c236d74acee6f00f85f687408000000bb696774b26967741c767c0e2d000000ecb7ff7527000000d0cc0e7680ee6f002d000000d0cc0e7627000000b0ee6f00856a68741c236d74f8ee6f007e8a0d76ee8c0d76738a0d76cc9d3ee62d000000ecb7ff7527000000d0cc0e762c118b00c0108b00cc9d3ee6c0ee6f00fc524b76acef6f00e0840d760c821890feffffff738a0d76 (UID: 00000000-00007572) "loader_domain.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007572) "loader_domain.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000667400008b00000000002d6e66749c767c0e11000000181a2572b0ee6f0064ee6f00d83f8b00110000000000000080000000f0ed6f00b73aa97274ee6f0070c8677448e97f7afeffffff11000000503c26720e00000044ee6f00856a68741c236d7484ee6f00f85f687408000000bb696774b269677434767c0e11000000181a25720e000000503c267258ee6f0011000000503c26720e00000088ee6f00856a68741c236d74d0ee6f00b90e267236142672ae0e26722926086d11000000181a25720e000000503c2672782f8b00402f8b002926086d98ee6f000a5e257284ef6f0040142672a16a401ffeffffffae0e2672c80e2672503c267200ef6f00 (UID: 00000000-00007572)2b:T10d9,"loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\C:\Users\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Videos\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Searches\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Saved Games\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Pictures\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Pictures\Saved Pictures\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Pictures\Camera Roll\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\OneDrive\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Music\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\backups\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Links\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Favorites\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Favorites\Links\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Downloads\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Documents\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Documents\Outlook Files\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Desktop\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\Contacts\o7k3OQSE9.README.txt (UID: 00000000-00007572) "loader_domain.exe" called "CopyFileW" to copy \\?\C:\o7k3OQSE9.README.txt to new location \\?\%USERPROFILE%\AppData\o7k3OQSE9.README.txt (UID: 00000000-00007572)2c:T4f8,Found reference to API (Indicator: "GetCommandLineW"; File: "loader_domain.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "loader_domain.exe") Found reference to API (Indicator: "FreeLibrary"; File: "loader_domain.exe") Found reference to API (Indicator: "GetLastError"; File: "loader_domain.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "loader_domain.exe") Found reference to API (Indicator: "GetTickCount"; File: "loader_domain.exe") Found reference to API (Indicator: "SetLastError"; File: "loader_domain.exe") Found reference to API (Indicator: "CreateMenu"; File: "loader_domain.exe") Found reference to API (Indicator: "LoadImageW"; File: "loader_domain.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "loader_domain.exe") Found reference to API (Indicator: "LoadMenuW"; File: "loader_domain.exe") Found reference to API (Indicator: "GetKeyNameTextW"; File: "loader_domain.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "loader_domain.exe") Found reference to API (Indicator: "GetTextColor"; File: "loader_domain.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "loader_domain.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "loader_domain.exe")2d:Ta35,"loader_domain.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72990000 "loader_domain.exe" loaded module "NTDLL" at base 77310000 "loader_domain.exe" loaded module "NTDLL.DLL" at base 77310000 "loader_domain.exe" loaded module "KERNEL32.DLL" at base 75f00000 "loader_domain.exe" loaded module "ADVAPI32.DLL" at base 753f0000 "loader_domain.exe" loaded module "CRYPTBASE" at base 73d20000 "loader_domain.exe" loaded module "USERENV.DLL" at base 72960000 "loader_domain.exe" loaded module "USER32.DLL" at base 73d60000 "loader_domain.exe" loaded module "GDI32.DLL" at base 745b0000 "loader_domain.exe" loaded module "SHELL32.DLL" at base 75fd0000 "loader_domain.exe" loaded module "OLE32.DLL" at base 74410000 "loader_domain.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0" at base 746e0000 "loader_domain.exe" loaded module "SHLWAPI.DLL" at base 75130000 "loader_domain.exe" loaded module "OLEAUT32.DLL" at base 74510000 "loader_domain.exe" loaded module "WTSAPI32.DLL" at base 73930000 "loader_domain.exe" loaded module "RSTRTMGR.DLL" at base 72930000 "loader_domain.exe" loaded module "NETAPI32.DLL" at base 728c0000 "loader_domain.exe" loaded module "WKSCLI" at base 72bf0000 "loader_domain.exe" loaded module "SRVCLI" at base 728a0000 "loader_domain.exe" loaded module "SAMCLI" at base 72880000 "loader_domain.exe" loaded module "NETUTILS" at base 72bb0000 "loader_domain.exe" loaded module "LOGONCLI" at base 72850000 "loader_domain.exe" loaded module "ACTIVEDS.DLL" at base 72810000 "loader_domain.exe" loaded module "WININET.DLL" at base 72500000 "loader_domain.exe" loaded module "WSOCK32.DLL" at base 724f0000 "loader_domain.exe" loaded module "WS2_32" at base 75730000 "loader_domain.exe" loaded module "MPR.DLL" at base 73c30000 "loader_domain.exe" loaded module "WINSPOOL.DRV" at base 72480000 "loader_domain.exe" loaded module "GPEDIT.DLL" at base 72370000 "loader_domain.exe" loaded module "RPCRT4.DLL" at base 742f0000 "loader_domain.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73880000 "loader_domain.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75470000 "loader_domain.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 721d0000 "loader_domain.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 720a0000 "loader_domain.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72060000 "loader_domain.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75470000 "loader_domain.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 754700002e:T4a3,"0f00100008f86f00b013357788f86f00@ntdll.dll" "07000800e4f76f0080fd3f7764f86f00@ntdll.dll" "09000a00e4f76f00c0fd3f7764f86f00@ntdll.dll" "08000900e4f76f00e0fc3f7764f86f00@ntdll.dll" "07000800e4f76f00e085337764f86f00@ntdll.dll" "09000a00e4f76f008057337764f86f00@ntdll.dll" "08000900e4f76f00e056337764f86f00@ntdll.dll" "11001200e4f76f00702ad27364f86f00@CRYPTBASE.dll" "11001200e4f76f00e02ad27364f86f00@CRYPTBASE.dll" "0c000d00e4f76f00003d7d7464f86f00@combase.dll" "0e000f00e4f76f00106e777464f86f00@combase.dll" "0e000f00e4f76f00606e777464f86f00@combase.dll" "14001500e4f76f002023747464f86f00@combase.dll" "10001100e4f76f008004777464f86f00@combase.dll" "12001300e4f76f0010c77d7464f86f00@combase.dll" "11001200e4f76f0050bc777464f86f00@combase.dll" "15001600e4f76f00c032bf7264f86f00@WKSCLI.DLL" "0c000d00e4f76f0010438a7264f86f00@SRVCLI.DLL" "0b000c00e4f76f008039887264f86f00@SAMCLI.DLL" "0e000f00e4f76f00d0da887264f86f00@SAMCLI.DLL" "0e000f00e4f76f00403e887264f86f00@SAMCLI.DLL" "10001100e4f76f00d017bb7264f86f00@NETUTILS.DLL" "0c000d00e4f76f0050ef857264f86f00@LOGONCLI.DLL" "0c000d00e4f76f0050cf867264f86f00@LOGONCLI.DLL" "0c000d00e4f76f00d0cd867264f86f00@LOGONCLI.DLL"2f:T41e,"loader_domain.exe" touched "WbemAdministrativeLocator Class" (Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}") "loader_domain.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "loader_domain.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "loader_domain.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "loader_domain.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "loader_domain.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "loader_domain.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")30:T841e,"setuserenv.vbs.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\setuserenv.vbs.o7k3OQSE9]- [targetUID: 00000000-00007572] "elevate.vbs.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\elevate.vbs.o7k3OQSE9]- [targetUID: 00000000-00007572] "unsetuserenv.vbs.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\unsetuserenv.vbs.o7k3OQSE9]- [targetUID: 00000000-00007572] "OneNote Guide.one.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.o7k3OQSE9]- [targetUID: 00000000-00007572] "Quick Notes.one.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.o7k3OQSE9]- [targetUID: 00000000-00007572] "Database1.accdb.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\Database1.accdb.o7k3OQSE9]- [targetUID: 00000000-00007572] "Outlook1.pst.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\Outlook Files\Outlook1.pst.o7k3OQSE9]- [targetUID: 00000000-00007572] "Outlook.pst.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\Outlook Files\Outlook.pst.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "CHANGELOG.md.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\CHANGELOG.md.o7k3OQSE9]- [targetUID: 00000000-00007572] "README.md.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\README.md.o7k3OQSE9]- [targetUID: 00000000-00007572] "unins000.dat.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\unins000.dat.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "text.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\text.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "updater.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\updater.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "o7k3OQSE9.ico" has type "MS Windows icon resource - 3 icons 48x48 32 bits/pixel 32x32 32 bits/pixel"- Location: [%ALLUSERSPROFILE%\o7k3OQSE9.ico]- [targetUID: 00000000-00007572] "text.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\text.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "RGI_Emoji.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\RGI_Emoji.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "RGI_Emoji.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\RGI_Emoji.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "store.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\store.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "yallist.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\yallist.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\lib\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "Open Notebook.onetoc2.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "Open Notebook.onetoc2.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "README.md.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\README.md.o7k3OQSE9]- [targetUID: 00000000-00007572] "Unfiled Notes.one.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\Unfiled Notes.one.o7k3OQSE9]- [targetUID: 00000000-00007572] "fetcher.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\fetcher.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "recent.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\Wireshark\recent.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\lib\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "parse.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\parse.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "scan.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\scan.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\lib\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "recent_common.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\Wireshark\recent_common.o7k3OQSE9]- [targetUID: 00000000-00007572] "posix.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\posix.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "error.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\error.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "npm.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\npm.o7k3OQSE9]- [targetUID: 00000000-00007572] "npx.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\npx.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "posix.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\posix.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "win32.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\win32.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "win32.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\win32.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "browser.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\browser.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "Microsoft OneNote.searchconnector-ms.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.o7k3OQSE9]- [targetUID: 00000000-00007572] "README.md.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\README.md.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "Microsoft Office Outlook.searchconnector-ms.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Searches\Microsoft Office Outlook.searchconnector-ms.o7k3OQSE9]- [targetUID: 00000000-00007572] "tmpfile.js.o7k3OQSE9" has type "DOS executable (COM) start instruction 0xb8394433 19de6864"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\utils\tmpfile.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "license.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\license.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "license.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\license.o7k3OQSE9]- [targetUID: 00000000-00007572] "license.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\license.o7k3OQSE9]- [targetUID: 00000000-00007572] "license.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\license.o7k3OQSE9]- [targetUID: 00000000-00007572] "license.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\string-width\license.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\string-width\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "license.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\license.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\string-width\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE-MIT.txt.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "which.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\bin\which.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "OpenPGP Public Key"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "winrt--_S-1-5-21-735145574-3570218355-1207367261-1001_-.searchconnector-ms.o7k3OQSE9" has type "Unknown"- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\treeverse\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.md.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\LICENSE.md.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "LICENSE.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "MicrosoftEdgeFavoritesBackup.html.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\MicrosoftEdgeFavoritesBackup.html.o7k3OQSE9]- [targetUID: 00000000-00007572] "config.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\config.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "url.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\utils\url.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\mjs\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "corepack.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\corepack.o7k3OQSE9]- [targetUID: 00000000-00007572] "History.md.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\History.md.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\lib\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "iterator.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\iterator.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\lib\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "Bing.url.o7k3OQSE9" has type "Unknown"- Location: [%USERPROFILE%\Favorites\Bing.url.o7k3OQSE9]- [targetUID: 00000000-00007572] "AUTHORS.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\AUTHORS.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "index.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "node.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\node.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "options.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\options.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "settings.txt.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\settings.txt.o7k3OQSE9]- [targetUID: 00000000-00007572] "options.js.o7k3OQSE9" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\options.js.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\cjs\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\mjs\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "package.json.o7k3OQSE9" has type "data"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\Sun\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\MicrosoftEdgeBackups\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\AppData\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Desktop\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\lib\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Documents\Outlook Files\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Downloads\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Videos\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\mjs\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\string-width\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Pictures\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Documents\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Searches\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Favorites\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\Wireshark\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Pictures\Camera Roll\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Saved Games\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Favorites\Links\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\OneDrive\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [C:\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\Sun\Java\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Music\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\MicrosoftEdgeBackups\backups\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Pictures\Saved Pictures\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Links\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\utils\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\lib\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%USERPROFILE%\Contacts\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\lib\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [C:\Users\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\lib\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\bin\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\treeverse\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\cjs\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\Wireshark\profiles\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\lib\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\tap-snapshots\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572] "o7k3OQSE9.README.txt" has type "Unknown"- Location: [%APPDATA%\Sun\Java\Deployment\o7k3OQSE9.README.txt]- [targetUID: 00000000-00007572]31:T6c2,"loader_domain.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\TREATAS"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\TREATAS"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER32"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER32"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER"; Key: ""; Value: "") "loader_domain.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER"; Key: ""; Value: "")32:T859,"loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: ""; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: ""; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: "APPID"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING DIRECTORY"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOG FILE MAX SIZE"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}"; Key: ""; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "loader_domain.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32"; Key: ""; Value: "")33:T5c7,"loader_domain.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "loader_domain.exe" trying to access non-existent file "C:\FLTLIB.DLL" "loader_domain.exe" trying to access non-existent file "C:\MSVCP140.DLL" "loader_domain.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "loader_domain.exe" trying to access non-existent file "C:\USERENV.DLL" "loader_domain.exe" trying to access non-existent file "C:\userenv.dll" "loader_domain.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "loader_domain.exe" trying to access non-existent file "C:\wtsapi32.dll" "loader_domain.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "loader_domain.exe" trying to access non-existent file "C:\RstrtMgr.dll" "loader_domain.exe" trying to access non-existent file "C:\NCRYPT.DLL" "loader_domain.exe" trying to access non-existent file "C:\ncrypt.dll" "loader_domain.exe" trying to access non-existent file "C:\BCRYPT.DLL" "loader_domain.exe" trying to access non-existent file "C:\bcrypt.dll" "loader_domain.exe" trying to access non-existent file "C:\NTASN1.DLL" "loader_domain.exe" trying to access non-existent file "C:\NTASN1.dll" "loader_domain.exe" trying to access non-existent file "C:\NETAPI32.DLL" "loader_domain.exe" trying to access non-existent file "C:\netapi32.dll" "loader_domain.exe" trying to access non-existent file "C:\WKSCLI.DLL" "loader_domain.exe" trying to access non-existent file "C:\SRVCLI.DLL"34:T34e6,Heuristic match: "@lby.rw" Pattern match: "ub7xk.wm/+h40o$x\n$2pq'+nv&8=}v7pohx'dxvjh&&odsr!hskx" Pattern match: "q.yj/@-cfi4jmwa" Pattern match: "uf.tt/ul" Pattern match: "i7dfvr.hps/6#.1ff/bp=|s}!i?y/t~b`n%akq" Pattern match: "https://tox.chat/add" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\changelog.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\which\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\history.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\tiny-relative-date\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\ssri\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\sprintf-js\contributors.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\index.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\migratingfromv1.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\examples\index.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\examples\typescript\associateexample.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\examples\typescript\bindexample.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\examples\typescript\connectexample.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\examples\javascript\associateexample.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\examples\javascript\bindexample.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\socks\docs\examples\javascript\connectexample.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\semver\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\safer-buffer\porting-buffer.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\qrcode-terminal\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\postcss-selector-parser\api.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\path-scurry\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\parse-conflict-json\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\pacote\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\npm-registry-fetch\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\npm-profile\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\npm-pick-manifest\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\nopt\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\changelog.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\contributing.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\macos_catalina_acid_test.sh" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\security.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\src\win_delay_load_hook.cc" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\gyp_main.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\test_gyp.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\markers.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\metadata.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\requirements.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\specifiers.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\tags.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\utils.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\version.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_elffile.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_manylinux.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_musllinux.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_parser.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_structures.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_tokenizer.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\__init__.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\common.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\common_test.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\easy_xml.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\easy_xml_test.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\flock_tool.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\input.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\input_test.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\mac_tool.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvsnew.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvsproject.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvssettings.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvssettings_test.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvstoolfile.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvsuserfile.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvsutil.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvsversion.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\msvs_emulation.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\ninja_syntax.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\simple_copy.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\win_tool.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcodeproj_file.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcode_emulation.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcode_ninja.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xml_fix.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\__init__.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\analyzer.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\android.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\cmake.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\eclipse.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\gypd.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\gypsh.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\make.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\msvs.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\msvs_test.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\ninja.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\ninja_test.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\xcode.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\xcode_test.py" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\data\win\large-pdb-shim.cc" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\negotiator\history.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\ms\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmversion\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmteam\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmsearch\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmpublish\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmpack\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmorg\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmhook\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmhook\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmfund\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmexec\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmdiff\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\libnpmaccess\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\json-parse-even-better-errors\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\jackspeak\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\init-package-json\license.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\glob\readme.md" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\exponential-backoff\dist\delay\always\o7k3oqse9.re" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\@isaacs\cliui\node_modules\strip-ansi\o7k3oqse9.re" Heuristic match: "\\?\%appdata%\nvm\v20.15.0\node_modules\npm\node_modules\@isaacs\cliui\node_modules\ansi-regex\o7k3oqse9.re" Pattern match: "www.xinhuanet.com\o7k3oqse9.r" Pattern match: "www.friv.com\o7k3oqse9.readme" Pattern match: "www.xinhuanet.com\o7k3oqse9.readme.txt" Pattern match: "www.xinhuanet.com\2014websit\o7k3oqse9.readme" Pattern match: "www.xinhuanet.com\2014websit\js\o7k3oqse9.rea" Pattern match: "www.xinhuanet.com\2014websit\js\kkplayer2.0_x" Pattern match: "www.friv.com\o7k3oqse9.readme.txt" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "u5on.ag" Heuristic match: "enerate_stdlib_module_names.py" Pattern match: "www.friv.com\friv_so1.sol.o7k3oqse9" Heuristic match: "ia\flash player\macromedia.com\support\flashplayer\sys\#sta.ganjistatic1.com" Pattern match: "www.xinhuanet.com\2014websit\js\kkplayer2.0_xhn.swf\kkv.sol.o7k3oqse9" Pattern match: "www.xinhuanet.com\2014websit\js\kkplayer2.0_xhn.swf\" Pattern match: "www.xinhuanet.com\2014websit\js\kkplayer2.0_xhn.swf\kkv.sol" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\tcl\tix8.4.3\pref\wmdefault.py" Heuristic match: "justify.xbm.tp" Pattern match: "https://tox.chat/"35:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp")36:T4c6,Found reference to API "1174202646,5564,3025,,RtlGetNtProductType,NTDLL.dll,"01:12:00.843",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "1226381740,5564,3025,,RtlGetNtProductType,NTDLL.dll,"01:12:00.859",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "1171788290,5564,3025,,RtlGetNtProductType,NTDLL.dll,"01:12:00.843",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "1173518954,5564,3025,,RtlGetNtProductType,NTDLL.dll,"01:12:00.843",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "1174506582,5564,3024,,RtlGetVersion,NTDLL.dll,"01:12:00.843",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "1221536074,5564,3025,,RtlGetNtProductType,NTDLL.dll,"01:12:00.859",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp")37:T9c1,"loader_domain.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter aadtb.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AboveLockAppHost.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter accountaccessor.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AccountsRt.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AcGenral.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AcLayers.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AcSpecfc.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter ActivationClient.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter ActivationManager.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter ActiveSyncProvider.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AcWinRT.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter acwow64.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AcXtrnal.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AdaptiveCards.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AddressParser.dll (UID: 00000000-00007572) "loader_domain.exe" called "FindNextFileW" with parameter AdmTmpl.dll (UID: 00000000-00007572)38:Tf4e,Found reference to API "0805519258,5564,3120,,FindNextFileW,kernel32.dll,"01:12:00.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "0794963120,5564,3120,,FindNextFileW,kernel32.dll,"01:12:00.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "0804842996,5564,3120,,FindNextFileW,kernel32.dll,"01:12:00.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "0800309600,5564,3120,,FindNextFileW,kernel32.dll,"01:12:00.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "0804507768,5564,3120,,FindNextFileW,kernel32.dll,"01:12:00.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "0799975580,5564,3120,,FindNextFileW,kernel32.dll,"01:12:00.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "0799638190,5564,3120,,FindNextFileW,kernel32.dll,"01:12:00.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000000.276536.00930000.00000004.mdmp") Found reference to API "3247968416,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.875",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "3057863164,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "3276261172,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.875",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "2542347206,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.578",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "3073183276,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "3262493272,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.875",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "2573310176,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.593",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "2942199516,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.750",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "3027843326,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.781",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "2984430284,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.765",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "2722078010,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.656",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "3087418718,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp") Found reference to API "2998601136,2496,3120,,FindNextFileW,kernel32.dll,"01:12:30.765",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00007572.00000001.278457.00930000.00000004.mdmp")39:Tfd9,Dropped file: "setuserenv.vbs.o7k3OQSE9" - Location: [%APPDATA%\nvm\setuserenv.vbs.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "elevate.vbs.o7k3OQSE9" - Location: [%APPDATA%\nvm\elevate.vbs.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "unsetuserenv.vbs.o7k3OQSE9" - Location: [%APPDATA%\nvm\unsetuserenv.vbs.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "LICENSE.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "CHANGELOG.md.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\CHANGELOG.md.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "README.md.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\README.md.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "unins000.dat.o7k3OQSE9" - Location: [%APPDATA%\nvm\unins000.dat.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "index.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "text.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\text.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "index.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "updater.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\updater.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "text.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\text.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "RGI_Emoji.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\RGI_Emoji.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "RGI_Emoji.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\RGI_Emoji.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "LICENSE.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "store.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\store.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "LICENSE.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\LICENSE.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "yallist.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\yallist.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "index.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\lib\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "package.json.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\package.json.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "index.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "index.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "index.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\index.js.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "README.md.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\README.md.o7k3OQSE9]- [targetUID: 00000000-00007572] Dropped file: "fetcher.js.o7k3OQSE9" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\fetcher.js.o7k3OQSE9]- [targetUID: 00000000-00007572]3a:T3c21,Dropped file "%APPDATA%\nvm\setuserenv.vbs.o7k3OQSE9" has high entropy 7.72315 Dropped file "%APPDATA%\nvm\elevate.vbs.o7k3OQSE9" has high entropy 7.66127 Dropped file "%APPDATA%\nvm\unsetuserenv.vbs.o7k3OQSE9" has high entropy 7.59512 Dropped file "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.o7k3OQSE9" has high entropy 7.94824 Dropped file "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.o7k3OQSE9" has high entropy 7.9995 Dropped file "%USERPROFILE%\Documents\Database1.accdb.o7k3OQSE9" has high entropy 7.99954 Dropped file "%USERPROFILE%\Documents\Outlook Files\Outlook1.pst.o7k3OQSE9" has high entropy 7.99935 Dropped file "%USERPROFILE%\Documents\Outlook Files\Outlook.pst.o7k3OQSE9" has high entropy 7.99943 Dropped file "%APPDATA%\nvm\v20.15.0\LICENSE.o7k3OQSE9" has high entropy 7.99843 Dropped file "%APPDATA%\nvm\v20.15.0\CHANGELOG.md.o7k3OQSE9" has high entropy 7.99656 Dropped file "%APPDATA%\nvm\v20.15.0\README.md.o7k3OQSE9" has high entropy 7.99526 Dropped file "%APPDATA%\nvm\unins000.dat.o7k3OQSE9" has high entropy 7.99039 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js.o7k3OQSE9" has high entropy 7.99004 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\text.js.o7k3OQSE9" has high entropy 7.98844 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js.o7k3OQSE9" has high entropy 7.98862 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\updater.js.o7k3OQSE9" has high entropy 7.98921 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\text.js.o7k3OQSE9" has high entropy 7.98854 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\RGI_Emoji.js.o7k3OQSE9" has high entropy 7.98644 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\RGI_Emoji.js.o7k3OQSE9" has high entropy 7.98721 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\LICENSE.o7k3OQSE9" has high entropy 7.98677 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\store.js.o7k3OQSE9" has high entropy 7.98553 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\LICENSE.o7k3OQSE9" has high entropy 7.98131 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\yallist.js.o7k3OQSE9" has high entropy 7.98088 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\lib\index.js.o7k3OQSE9" has high entropy 7.97364 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\package.json.o7k3OQSE9" has high entropy 7.97024 Dropped file "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.o7k3OQSE9" has high entropy 7.97344 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\index.js.o7k3OQSE9" has high entropy 7.97031 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\index.js.o7k3OQSE9" has high entropy 7.9709 Dropped file "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.o7k3OQSE9" has high entropy 7.96227 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\index.js.o7k3OQSE9" has high entropy 7.95954 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\README.md.o7k3OQSE9" has high entropy 7.96136 Dropped file "%USERPROFILE%\Documents\OneNote Notebooks\Unfiled Notes.one.o7k3OQSE9" has high entropy 7.95143 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\fetcher.js.o7k3OQSE9" has high entropy 7.94244 Dropped file "%APPDATA%\Wireshark\recent.o7k3OQSE9" has high entropy 7.94097 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\lib\index.js.o7k3OQSE9" has high entropy 7.93382 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\parse.js.o7k3OQSE9" has high entropy 7.9494 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\scan.js.o7k3OQSE9" has high entropy 7.93669 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\lib\index.js.o7k3OQSE9" has high entropy 7.93781 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\package.json.o7k3OQSE9" has high entropy 7.93109 Dropped file "%APPDATA%\Wireshark\recent_common.o7k3OQSE9" has high entropy 7.92628 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\posix.js.o7k3OQSE9" has high entropy 7.92851 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\error.js.o7k3OQSE9" has high entropy 7.92598 Dropped file "%APPDATA%\nvm\v20.15.0\npm.o7k3OQSE9" has high entropy 7.9112 Dropped file "%APPDATA%\nvm\v20.15.0\npx.o7k3OQSE9" has high entropy 7.90643 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\index.js.o7k3OQSE9" has high entropy 7.91787 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\index.js.o7k3OQSE9" has high entropy 7.91912 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\posix.js.o7k3OQSE9" has high entropy 7.92529 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\win32.js.o7k3OQSE9" has high entropy 7.90359 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\package.json.o7k3OQSE9" has high entropy 7.91154 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\win32.js.o7k3OQSE9" has high entropy 7.90028 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\browser.js.o7k3OQSE9" has high entropy 7.90501 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\package.json.o7k3OQSE9" has high entropy 7.87923 Dropped file "%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.o7k3OQSE9" has high entropy 7.86976 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\README.md.o7k3OQSE9" has high entropy 7.87086 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\package.json.o7k3OQSE9" has high entropy 7.88032 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\package.json.o7k3OQSE9" has high entropy 7.87482 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\package.json.o7k3OQSE9" has high entropy 7.89692 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\package.json.o7k3OQSE9" has high entropy 7.88128 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\package.json.o7k3OQSE9" has high entropy 7.87034 Dropped file "%USERPROFILE%\Searches\Microsoft Office Outlook.searchconnector-ms.o7k3OQSE9" has high entropy 7.86896 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\utils\tmpfile.js.o7k3OQSE9" has high entropy 7.86839 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\package.json.o7k3OQSE9" has high entropy 7.87102 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\LICENSE.o7k3OQSE9" has high entropy 7.86515 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\license.o7k3OQSE9" has high entropy 7.85609 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\LICENSE.o7k3OQSE9" has high entropy 7.85625 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\license.o7k3OQSE9" has high entropy 7.88576 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\license.o7k3OQSE9" has high entropy 7.86242 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\license.o7k3OQSE9" has high entropy 7.86283 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\string-width\license.o7k3OQSE9" has high entropy 7.87922 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\string-width\index.js.o7k3OQSE9" has high entropy 7.86377 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\package.json.o7k3OQSE9" has high entropy 7.85813 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\node_modules\ansi-styles\license.o7k3OQSE9" has high entropy 7.86333 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\string-width\package.json.o7k3OQSE9" has high entropy 7.86363 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt.o7k3OQSE9" has high entropy 7.86783 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\LICENSE.o7k3OQSE9" has high entropy 7.86195 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi-cjs\package.json.o7k3OQSE9" has high entropy 7.85362 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\package.json.o7k3OQSE9" has high entropy 7.83542 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\package.json.o7k3OQSE9" has high entropy 7.86325 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\bin\which.js.o7k3OQSE9" has high entropy 7.85416 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\package.json.o7k3OQSE9" has high entropy 7.80361 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\package.json.o7k3OQSE9" has high entropy 7.82934 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\LICENSE.o7k3OQSE9" has high entropy 7.81647 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\package.json.o7k3OQSE9" has high entropy 7.83628 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\LICENSE.o7k3OQSE9" has high entropy 7.79625 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\LICENSE.o7k3OQSE9" has high entropy 7.81176 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\treeverse\LICENSE.o7k3OQSE9" has high entropy 7.82204 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\LICENSE.o7k3OQSE9" has high entropy 7.78973 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\LICENSE.o7k3OQSE9" has high entropy 7.80659 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\write-file-atomic\LICENSE.md.o7k3OQSE9" has high entropy 7.78031 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-name\LICENSE.o7k3OQSE9" has high entropy 7.80541 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\package.json.o7k3OQSE9" has high entropy 7.7812 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\LICENSE.o7k3OQSE9" has high entropy 7.79292 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\package.json.o7k3OQSE9" has high entropy 7.78151 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\index.js.o7k3OQSE9" has high entropy 7.76803 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\index.js.o7k3OQSE9" has high entropy 7.74844 Dropped file "%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\MicrosoftEdgeFavoritesBackup.html.o7k3OQSE9" has high entropy 7.72121 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\config.js.o7k3OQSE9" has high entropy 7.77222 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\index.js.o7k3OQSE9" has high entropy 7.72089 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\cjs\index.js.o7k3OQSE9" has high entropy 7.72195 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tuf-js\dist\utils\url.js.o7k3OQSE9" has high entropy 7.74757 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\wrap-ansi\node_modules\ansi-regex\index.js.o7k3OQSE9" has high entropy 7.62096 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\mjs\index.js.o7k3OQSE9" has high entropy 7.60597 Dropped file "%APPDATA%\nvm\v20.15.0\corepack.o7k3OQSE9" has high entropy 7.66672 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\History.md.o7k3OQSE9" has high entropy 7.63972 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-slug\lib\index.js.o7k3OQSE9" has high entropy 7.62675 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\iterator.js.o7k3OQSE9" has high entropy 7.55847 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\unique-filename\lib\index.js.o7k3OQSE9" has high entropy 7.50463 Dropped file "%USERPROFILE%\Favorites\Bing.url.o7k3OQSE9" has high entropy 7.48067 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\AUTHORS.o7k3OQSE9" has high entropy 7.52155 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\index.js.o7k3OQSE9" has high entropy 7.49892 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\index.js.o7k3OQSE9" has high entropy 7.46186 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\util-deprecate\node.js.o7k3OQSE9" has high entropy 7.42839 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\options.js.o7k3OQSE9" has high entropy 7.38373 Dropped file "%APPDATA%\nvm\settings.txt.o7k3OQSE9" has high entropy 7.32724 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\options.js.o7k3OQSE9" has high entropy 7.2978 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\cjs\package.json.o7k3OQSE9" has high entropy 7.25892 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\cjs\package.json.o7k3OQSE9" has high entropy 7.14949 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\walk-up-path\dist\mjs\package.json.o7k3OQSE9" has high entropy 7.21834 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\package.json.o7k3OQSE9" has high entropy 7.276733b:T11dd,"loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft Office Outlook.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft Office Outlook.searchconnector-ms.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft OneNote.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms" to "%USERPROFILE%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\MicrosoftEdgeFavoritesBackup.html" to "%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\MicrosoftEdgeFavoritesBackup.html.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Favorites\Bing.url" to "%USERPROFILE%\Favorites\Bing.url.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\Database1.accdb" to "%USERPROFILE%\Documents\Database1.accdb.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook.pst.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook1.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook1.pst.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\Unfiled Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\Unfiled Notes.one.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\elevate.vbs" to "%APPDATA%\nvm\elevate.vbs.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\settings.txt" to "%APPDATA%\nvm\settings.txt.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\setuserenv.vbs" to "%APPDATA%\nvm\setuserenv.vbs.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\unins000.dat" to "%APPDATA%\nvm\unins000.dat.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\unsetuserenv.vbs" to "%APPDATA%\nvm\unsetuserenv.vbs.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\CHANGELOG.md" to "%APPDATA%\nvm\v20.15.0\CHANGELOG.md.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\README.md" to "%APPDATA%\nvm\v20.15.0\README.md.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\node_modules\npm\index.js" to "%APPDATA%\nvm\v20.15.0\node_modules\npm\index.js.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\node_modules\npm\package.json" to "%APPDATA%\nvm\v20.15.0\node_modules\npm\package.json.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\node_modules\npm\README.md" to "%APPDATA%\nvm\v20.15.0\node_modules\npm\README.md.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\node_modules\npm\node_modules\yallist\iterator.js" to "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\iterator.js.o7k3OQSE9" "loader_domain.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\node_modules\npm\node_modules\yallist\package.json" to "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\yallist\package.json.o7k3OQSE9"3c:Tae5,"loader_domain.exe" opened "C:\Users\%OSUSER%\Searches\Microsoft Office Outlook.searchconnector-ms" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Searches\Microsoft OneNote.searchconnector-ms" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20260201\MicrosoftEdgeFavoritesBackup.html" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Favorites\Bing.url" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\Database1.accdb" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\Outlook Files\Outlook1.pst" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\Unfiled Notes.one" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Wireshark\recent_common" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\elevate.vbs" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\settings.txt" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\setuserenv.vbs" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\unins000.dat" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\unsetuserenv.vbs" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\CHANGELOG.md" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\corepack" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\LICENSE" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\npm" with delete access "loader_domain.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\nvm\v20.15.0\npx" with delete access1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790546521193,"unified_at":"2026-09-27T22:02:01.193Z","metadata":{"hashes":{"sha256":"47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25","sha1":"ac22c26cae3ae7842b8e60eb3ec23a0cdc16b88d","md5":"4af3347681b6ef41b4d8a444c03ac6ce","sha512":"9ea9f0ec2b7e8da98865cd10a407bb9926227310eb9e4e7a089c3a9b2906305c1ec36d1945517cb2325348b4b2168121e8baf8eec57f32fb4ff2e695d50d3c23","ssdeep":"3072:E6glyuxE4GsUPnliByocWepngstnC51HOfbZ:E6gDBGpvEByocWeTtCDH","ssdeep_chunks":["3072:E6glyux","3072:6glyuxE","3072:glyuxE4","3072:lyuxE4G","3072:yuxE4Gs","3072:uxE4GsU","3072:xE4GsUP","3072:E4GsUPn","3072:4GsUPnl","3072:GsUPnli","3072:sUPnliB","3072:UPnliBy","3072:PnliByo","3072:nliByoc","3072:liByocW","3072:iByocWe","3072:ByocWep","3072:yocWepn","3072:ocWepng","3072:cWepngs","3072:Wepngst","3072:epngstn","3072:pngstnC","3072:ngstnC5","3072:gstnC51","3072:stnC51H","3072:tnC51HO","3072:nC51HOf","3072:C51HOfb","3072:51HOfbZ","6144:E6glyux","6144:6glyuxE","6144:glyuxE4","6144:lyuxE4G","6144:yuxE4Gs","6144:uxE4GsU","6144:xE4GsUP","6144:E4GsUPn","6144:4GsUPnl","6144:GsUPnli","6144:sUPnliB","6144:UPnliBy","6144:PnliByo","6144:nliByoc","6144:liByocW","6144:iByocWe","6144:ByocWep","6144:yocWepn","6144:ocWepng","6144:cWepngs","6144:Wepngst","6144:epngstn","6144:pngstnC","6144:ngstnC5","6144:gstnC51","6144:stnC51H","6144:tnC51HO","6144:nC51HOf","6144:C51HOfb","6144:51HOfbZ","3072:E6gDBGp","3072:6gDBGpv","3072:gDBGpvE","3072:DBGpvEB","3072:BGpvEBy","3072:GpvEByo","3072:pvEByoc","3072:vEByocW","3072:EByocWe","3072:ByocWeT","3072:yocWeTt","3072:ocWeTtC","3072:cWeTtCD","3072:WeTtCDH"],"imphash":"41fb8cb2943df6de998b35a9d28668e8"},"file_info":{"file_name":"loader_domain.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":148992,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1784686252000,"last_seen":1784691158000,"last_multi_scan":1784691158000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["lockbit","lockbitblack","criminal","ransomware","windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":56},"sandbox_signatures":{"informative_count":100,"suspicious_count":17,"malicious_count":6,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Ransomware/Win.LockBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.LockBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/ZeroAccess.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.BlackMatter.166","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.LockBitBlack-10033143-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.BlackMatter.166 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.BlackMatter.O trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crypmodng.gen.wfmv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.Qadars.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Ransom/LockFile.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a74ef1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Lockbit.tsu4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Lockbit-W","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Lockbit.148992","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXVB-PR!4AF3347681B6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/BlackMatter.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.LockBit.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.26912","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.BlackMatter.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"YARA signature match – LockBit Black ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"suspicious","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Selective Exclusion","attack_id":"T1679","attack_id_wiki":"https://attack.mitre.org/techniques/T1679","identifiers":[{"type":"informative","value":"Attempts to rename multiple files with a new extension, avoiding critical system files"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Writes to a desktop.ini file (may be used to cloak folders)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"},{"type":"informative","value":"Attempts to read Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"malicious","value":"Renames multiple files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"memory compression\" (Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"loader_domain.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$28","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"loader_domain.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n 10035FFFh in Stream UID: 3042-187-0040B470\n Assembly shows XOR instruction xor byte ptr [ebx-5CDFFFFFh]\n ah in Stream UID: 3042-761-0041791E\n Assembly shows XOR instruction xor ah\n byte ptr [ecx+eax+01A42000h] in Stream UID: 3042-778-00418DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.21237","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$29","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"loader_domain.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"loader_domain.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"loader_domain.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"loader_domain.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"loader_domain.exe\" called \"OpenMutexW\" with parameter \"Global\\2b01f85156751e0a9b0f80e535d6daa5\" - (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 3042-784-00418DD6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_ShadowCopy\" (Indicator: \"select * from \"; Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"loader_domain.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"1174506582,5564,3024,,RtlGetVersion,NTDLL.dll,\"01:12:00.843\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00007572.00000000.276536.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"loader_domain.exe\" writes to a file \"%APPDATA%\\o7k3OQSE9.README.txt\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"loader_domain.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"loader_domain.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\LOADER_DOMAIN.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\"loader_domain.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \"loader_domain.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook1.pst\"\n \"loader_domain.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"\n \"loader_domain.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$2b","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"loader_domain.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_ShadowCopy\" (Source: 00000000-00007572.00000001.278457.00930000.00000004.mdmp, Indicator: \"select * from win32_shadowcopy\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 3042-778-00418DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"loader_domain.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"loader_domain.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Registry\\Machine\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\" in Source: 00000000-00007572.00000001.278457.00930000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process loader_domain.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7572:168:WilStaging_02\"\n Process loader_domain.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7572:168:WilStaging_02\"\n Process loader_domain.exe created mutex with name \"\\BaseNamedObjects\\2b01f85156751e0a9b0f80e535d6daa5\"\n Process loader_domain.exe created mutex with name \"SM0:7572:168:WilStaging_02\"\n Process loader_domain.exe created mutex with name \"Local\\SM0:7572:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"tmpfile.js.o7k3OQSE9\" as clean (type is \"DOS executable (COM) start instruction 0xb8394433 19de6864\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"loader_domain.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"\\\\?\\%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\jsonparse\\examples\\twitterfeed.js\" (Indicator: \"twitter\"; Source: \"00000000-00007572-00000C59-3335002947\")\n Found string \"\\\\?\\%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\jsonparse\\examples\\twitterfeed.js.o7k3OQSE9\" (Indicator: \"twitter\"; Source: \"00000000-00007572-00000C59-3335002947\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Registry\\Machine\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\" in Source: 00000000-00007572.00000001.278457.00930000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \".pst\") in Source: 00000000-00007572-00000C59-3325569972\n \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst\" (Indicator: \".pst\") in Source: 00000000-00007572-00000C59-3325581453","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"loader_domain.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 743B0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"loader_domain.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 758F0000\n \"loader_domain.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72BD0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"loader_domain.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 742F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"loader_domain.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"tmpfile.js.o7k3OQSE9\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"loader_domain.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"loader_domain.exe\" has an executable section named \".text\"\n \"loader_domain.exe\" has an executable section named \".itext\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"loader_domain.exe\" has an writable section named \".data\"\n \"loader_domain.exe\" has an writable section named \".pdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"loader_domain.exe\" file has an entrypoint instructions - \"nop\t,nop\tword ptr [eax + eax],call\t0x419000,nop\tdword ptr [eax],call\t0x40639c,nop\t,call\t0x409990,nop\tdword ptr [eax],call\t0x417458,nop\tword ptr [eax + eax],push\t0,call\tdword ptr [0x4255c8],nop\tword ptr [eax + eax],call\t0x418dd6,call\t0x418dca,call\t0x418dbe,call\t0x418dd0,call\t0x418dbe,call\t0x418dbe,call\t0x418dc4,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"loader_domain.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"loader_domain.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"loader_domain.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"loader_domain.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"loader_domain.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\System32\\*.dll\" [Source: 00000000-00007572-00000C2E-393903502]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"loader_domain.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"loader_domain.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$30","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"loader_domain.exe\" queries basic process information of the \"C:\\loader_domain.exe\" (UID: 7572)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"loader_domain.exe\" reads file \"c:\\o7k3oqse9.readme.txt\"\n \"loader_domain.exe\" reads file \"c:\\users\\%osuser%\\searches\\microsoft office outlook.searchconnector-ms\"\n \"loader_domain.exe\" reads file \"c:\\users\\%osuser%\\searches\\microsoft onenote.searchconnector-ms\"\n \"loader_domain.exe\" reads file \"c:\\users\\%osuser%\\searches\\winrt--{s-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms\"\n \"loader_domain.exe\" reads file \"c:\\users\\%osuser%\\microsoftedgebackups\\backups\\microsoftedgebackup20260201\\microsoftedgefavoritesbackup.html\"\n \"loader_domain.exe\" reads file \"c:\\users\\%osuser%\\favorites\\bing.url\"\n \"loader_domain.exe\" reads file \"c:\\users\\%osuser%\\documents\\database1.accdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"loader_domain.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\loader_domain.exe\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp_win.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\user32.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32full.dll\"\n \"loader_domain.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"loader_domain.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"\n \"loader_domain.exe\" trying to access non-existent file \"C:\\winspool.drv\"\n \"loader_domain.exe\" trying to access non-existent file \"C:\\LOADER_DOMAIN.EXE.LOCAL\"\n \"loader_domain.exe\" trying to access non-existent file \"C:\\loader_domain.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"loader_domain.exe\" writes file \"c:\\programdata\\o7k3oqse9.ico\"\n \"loader_domain.exe\" writes file \"c:\\o7k3oqse9.readme.txt\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"loader_domain.exe\" writes a file \"%APPDATA%\\nvm\\unins000.dat.o7k3OQSE9\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00007572\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"loader_domain.exe\" appended encryption extension \".o7k3oqse9\" to 10+ files (.accdb, .html, .one, .pst, .searchconnector-ms, .url) — SELECTIVE EXCLUSION: no system file types or protected directories touched","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLEBB44B0432C100B9C1133FCB7D920]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: loader_domain.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"loader_domain.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72880000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"loader_domain.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"loader_domain.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetDriveTypeW\" with parameter \\\\?\\Volume{815ead30-0000-0000-0000-100000000000}\\ (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}\n \"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"0\"}\n \"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"5\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"loader_domain.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007572-00000C59-3325569972\")\n Found string \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst.o7k3OQSE9\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007572-00000C59-3325569972\")\n Found string \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007572-00000C59-3325581453\")\n Found string \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst.o7k3OQSE9\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007572-00000C59-3325581453\")\n Found string \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\o7k3OQSE9.README.txt\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007572-00000C3D-12087005146\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_ShadowCopy\" (Indicator: \" Win32_Shadowcopy\"; Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007572.00000000.276536.00930000.00000004.mdmp, 00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"1169984792,5564,113,,SystemParametersInfoW,user32.dll,\"01:12:00.843\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007572.00000000.276536.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"loader_domain.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"loader_domain.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"HOSTNAME\"; Value: \"\")\n \"loader_domain.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"DOMAIN\"; Value: \"\")\n \"loader_domain.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")\n \"loader_domain.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"LDAPCLIENTINTEGRITY\"; Value: \"\")\n \"loader_domain.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEOLDHOSTRESOLUTIONORDER\"; Value: \"\")\n \"loader_domain.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEHOSTNAMEASALIAS\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"loader_domain.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\.O7K3OQSE9\"; Key: \"(DEFAULT)\"; Value: \"o7k3OQSE9\"), \"loader_domain.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\O7K3OQSE9\\DEFAULTICON\"; Key: \"(DEFAULT)\"; Value: \"%ALLUSERSPROFILE%\\o7k3OQSE9.ico\"), \"loader_domain.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\"; Key: \"GLOBALASSOCCHANGEDCOUNTER\"; Value: \"2300000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"package.json.o7k3OQSE9 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$39","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"runtimebroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundtaskhost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"loader_domain.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Writes to a desktop.ini file (may be used to cloak folders)","description":"\"loader_domain.exe\" wrote to file \"C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini\"\n \"loader_domain.exe\" wrote to file \"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-34","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"loader_domain.exe\" has section name .data with entropy \"7.98678322770501\"\n \"loader_domain.exe\" has section name .pdata with entropy \"7.91321844922056\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"loader_domain.exe\" is setting \"ThreadHideFromDebugger\" data for its current thread\n \"loader_domain.exe\" is setting \"ThreadHideFromDebugger\" data for thread ID 0x398\n \"loader_domain.exe\" is setting \"ThreadHideFromDebugger\" data for thread ID 0x39c","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$3a","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/27 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"$3b","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"tmpfile.js.o7k3OQSE9\" has type \"DOS executable (COM) start instruction 0xb8394433 19de6864\"- Location: [%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\tuf-js\\dist\\utils\\tmpfile.js.o7k3OQSE9]- [targetUID: 00000000-00007572]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"ALL YOUR FILES ARE ENCRYPTED!You can decrypt one small file for free - for proof of our working decryptor.We will talk about the decryptor price on tox.Download TOX: https://tox.chat/Add my contact: B7BD3D86D04921A59BB1127EE59430C01BE0BB996A5809D3F239882A58FCA124800E0BFDEC86\" (Source: o7k3OQSE9.README.txt, Indicator: \"files are encrypted\")\n \"ALL YOUR FILES ARE ENCRYPTED!\" (Source: 00000000-00007572.00000001.278457.00930000.00000004.mdmp, Indicator: \"files are encrypted\")","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00007572.00000001.278457.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}\n \"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"0\"}\n \"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"5\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}\n \"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"0\"}\n \"loader_domain.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"5\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"loader_domain.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007572)\n \"loader_domain.exe\" called \"GetDriveTypeW\" with parameter \\\\?\\Volume{815ead30-0000-0000-0000-100000000000}\\ (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyNameTextW@USER32.dll at 3042-772-00418D9A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 3042-780-00418DC4\n GetCommandLineW@KERNEL32.dll at 3042-783-00418DCA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"loader_domain.exe\" claimed CRC 183513 while the actual is CRC 176063","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetCommandLineW\n LoadLibraryW\n GetCommandLineA\n GetTickCount","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/27 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – LockBit Black ransomware","description":"YARA signature for LockBit Black ransomware matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1204.002","relevance":10,"id":"yara-617","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"loader_domain.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00007572)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames multiple files with double extensions (often indicator of ransomware infection)","description":"\"loader_domain.exe\" renames more than 100 files with extension \".md.o7k3OQSE9\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":72,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":119,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["lockbit","lockbitblack","criminal","ransomware","windows-server-utility","evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6a6039d569fdb7c21d08feb1","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.BlackMatter","submit_name":"loader_domain.exe","analysis_start_time":"2026-07-22T03:32:38+00:00","indicators_count":{"informative":100,"suspicious":26,"malicious":6},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}],"processes":[{"pid":7572,"ppid":0,"name":"loader_domain.exe","command_line":"","sha256":"47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25","normalized_path":"C:\\loader_domain.exe","uid":"00000000-00007572","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["win32u.dll","powrprof.dll","ntasn1.dll","dsrole.dll","KernelBase.dll","ucrtbase.dll","ole32.dll","bcrypt.dll","dsuiext.dll","framedynos.dll","comctl32.dll","sspicli.dll","windows.storage.dll","adsldpc.dll","gpapi.dll","uxtheme.dll","ntmarta.dll","wbemsvc.dll","wow64.dll","apphelp.dll","cryptbase.dll","vcruntime140.dll","shell32.dll","netutils.dll","gdi32full.dll","msvcrt.dll","wtsapi32.dll","samcli.dll","wsock32.dll","wow64cpu.dll","profapi.dll","SHCore.dll","RstrtMgr.dll","srvcli.dll","ntdsapi.dll","ntdll.dll","logoncli.dll","dssec.dll","wbemprox.dll","rpcrt4.dll","bcryptprimitives.dll","VxSSL32.dll","activeds.dll","wow64win.dll","user32.dll","gdi32.dll","msvcp140.dll","oleaut32.dll","wkscli.dll","Wldap32.dll","gpedit.dll","kernel32.dll","msvcp_win.dll","mpr.dll","IPHLPAPI.DLL","wbemcomn.dll","combase.dll","ws2_32.dll","advapi32.dll","ncrypt.dll","netapi32.dll","imm32.dll","sechost.dll","userenv.dll","cfgmgr32.dll","clbcatq.dll","fltLib.dll","shlwapi.dll","wininet.dll","authz.dll","kernel.appcore.dll","fastprox.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"o7k3OQSE9.ico","sha256":"95e059ef72686460884b9aea5c292c22917f75d56fe737d43be440f82034f438","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"o7k3OQSE9.README.txt","sha256":"8e35fcb5e6e7e3741eb30839a7cd87e0d8163a39fb8bc26fec5937e97aac8ec6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"recent.o7k3OQSE9","sha256":"18888a6bdf7d4926b7d9e2231a306b22260d717cad962c0f28af1803e5888ec1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"recent_common.o7k3OQSE9","sha256":"a2b3818d4a61916300873839bfb3191e51825263fb62bb902eff45361b36e58e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"elevate.vbs.o7k3OQSE9","sha256":"364cc30ec9b65329e56c70f49f96ef3459dc235958c61d06e9b7f278eb171468","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"settings.txt.o7k3OQSE9","sha256":"422e0a6292c0b99c6491879439f9b4ea782c5eb31815f32cb44cfd30ea556da4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"setuserenv.vbs.o7k3OQSE9","sha256":"6da29c837c62f99d42e01163eec5885a470418dc824e2bdb0b6e992c7e4321f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"unins000.dat.o7k3OQSE9","sha256":"276dcbf390b9d3ed56a785d81df68657ed86dd76d4b5ac92d77597be1b0c4926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"unsetuserenv.vbs.o7k3OQSE9","sha256":"df8bb3e52be6eae709318813dcebc1e5b6e89f9f960ed0ef0604cc0955fb33d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"CHANGELOG.md.o7k3OQSE9","sha256":"5b4becc2d324166453e5d452bac2ac7deb114fadf2245cf60c65bb0bf2b1ef1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"LICENSE.o7k3OQSE9","sha256":"150ad610f3c7408f64284cbcca577a79c69e6c511dfb7d87fd87b7846a995088","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"README.md.o7k3OQSE9","sha256":"755ca3be143a415569405f2433214d1bed629a2781241ab9fb14b8b96d4e22c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"corepack.o7k3OQSE9","sha256":"28712bd1261398e13d2564b2a4744a85348a1d3811455c5771960d14f987fa82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%ALLUSERSPROFILE%\\o7k3OQSE9.ico","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"C:\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"C:\\Users\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Videos\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Searches\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft Office Outlook.searchconnector-ms.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft OneNote.searchconnector-ms.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Saved Games\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Searches\\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Pictures\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Pictures\\Saved Pictures\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Pictures\\Camera Roll\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\OneDrive\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Music\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\MicrosoftEdgeBackup20260201\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\MicrosoftEdgeBackup20260201\\MicrosoftEdgeFavoritesBackup.html.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Links\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Favorites\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Favorites\\Bing.url.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Downloads\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\Unfiled Notes.one.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\OneNote Guide.one.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\Open Notebook.onetoc2.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Desktop\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Contacts\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\AppData\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\Wireshark\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\Wireshark\\recent.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\Wireshark\\recent_common.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\Wireshark\\profiles\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\Sun\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\Sun\\Java\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\Sun\\Java\\Deployment\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\elevate.vbs.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\settings.txt.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\setuserenv.vbs.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\unins000.dat.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\unsetuserenv.vbs.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\CHANGELOG.md.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\corepack.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\LICENSE.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\npm.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\npx.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\README.md.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\LICENSE.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\README.md.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\tap-snapshots\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\yallist\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\yallist\\iterator.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\yallist\\LICENSE.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\yallist\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\write-file-atomic\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\yallist\\yallist.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\write-file-atomic\\LICENSE.md.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\write-file-atomic\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\write-file-atomic\\lib\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\write-file-atomic\\lib\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\license.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\node_modules\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\node_modules\\ansi-styles\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\node_modules\\ansi-styles\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\node_modules\\ansi-styles\\license.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi-cjs\\node_modules\\ansi-styles\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\license.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\strip-ansi\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\strip-ansi\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\strip-ansi\\license.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\strip-ansi\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\string-width\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\string-width\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\string-width\\license.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\string-width\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\LICENSE-MIT.txt.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\RGI_Emoji.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\es2015\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\text.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\es2015\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\es2015\\RGI_Emoji.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\ansi-regex\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\emoji-regex\\es2015\\text.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\ansi-regex\\index.js.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\ansi-regex\\license.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\wrap-ansi\\node_modules\\ansi-regex\\package.json.o7k3OQSE9","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"path":"%APPDATA%\\nvm\\v20.15.0\\node_modules\\npm\\node_modules\\which\\o7k3OQSE9.README.txt","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"\\BaseNamedObjects\\2b01f85156751e0a9b0f80e535d6daa5","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"SM0:7572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]},{"name":"Local\\SM0:7572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a6039d569fdb7c21d08feb1"}]}]}},"report_ids":{"sandbox_job_ids":["6a6039d569fdb7c21d08feb1"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.BlackMatter.Generic Sample 47f8790c9b5b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 47f8790c9b5b…. Malware family: Ransom.BlackMatter.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.BlackMatter.Generic Sample 47f8790c9b5b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 47f8790c9b5b…. Malware family: Ransom.BlackMatter.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/47f8790c9b5b9aab6ae179a192a91d4a5b4e6aac17c14f103858fa3b72ceba25"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.BlackMatter.Generic Sample 47f8790c9b5b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 47f8790c9b5b…. Malware family: Ransom.BlackMatter.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]