26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 48fe1f7de453… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 48fe1f7de453…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e"],"about":{"@type":"SoftwareApplication","name":"YoutubeAdvert.exe","applicationCategory":["peexe","executable"],"identifier":"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1e04,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp")28:Ta37,"YoutubeAdvert.exe" called "RtlGetVersion" (UID: 00000000-00004068) "YoutubeAdvert.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ff0000000000c038ff0000000000d220000000000000b037ff007f070000b818030100000000ff070000180001018000000023185273b4f7180045584077a2367d00000000000200000270d5020100000000b81803011000000000000000ff070000b0180301e62000c6c400ff000100000000000000020000000c000000b8180301b8180301b3180301000000005cf718000000ff00b8180301a0f6180068f71800c0fc18004558407782367d00feffffff16343c7741343c7794000000a0000000b2180301b01803019400000044f81800b914ce76e40f0000740c000010000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000018006f0fd6727c0fd672412014b400000000887c0701105a5b6e30f60301000000008c520b0100000000010000000000000001000000e4d318005cd31800e4d318000ce43b77da2b5e7740000000cc01ff000000ff0000000000887c07010b0097014200000000000000887c070101000000d8d418000c007301420000007c0fd672cf0ed672e077ff000000000040000000105a5b6e0000000038710501d074ff000076ff00b8170801387bff0028d41800b4d318007cd4180034d51800455840770ce43b775a2b5e77000000009c01ff000000ff00060000000000000004007100 (UID: 00000000-00004068)29:T1f84,"YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750726f6365737349642c302c302c2c6665340d0a00656c33322e646c6c2c223235323a30323a35362e323334222c52583d302c50583d30003030303030623131643030303030323030303030303533303036353030373230303736303036393030363330303635303032303030353030 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100b218f7af05b29cee743437a470000000000100000000000000010000003cf7af05000000002812110378f7af05d8c20a0148f7af058f9cee743437a470020000000000000018000000010000004cf7af052823be720000ff00000000000c0000008402120358f7af052f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310074204f0a01a0c2050100000000204f0a01100000000000000014d5180050dce676204f0a0110000000bc1708017435b6051000000040d51800a6ec526e02000000000000001800000028c7526e44d518002823be720000ff00000000000c00000028c7526e50d518002f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000003cd618006a6fd47200000000bc6fd472ea4508b7bcd1180000000000c0d71800155e6976aae178c1feffffff75017276e2d8fd742824907002000000000000001800000030a5a470fcd518002823be720000ff00000000000c00000030a5a47008d618002f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000090444d060ced330653a84c7390444d060000000018ed330648454c7390444d0658ed33068b3c4b7390444d0620000000281211032ccf26032812110302000000000000001800000090444d065ced33062823be720000ff00000000000c0000002ccf260368ed33062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000601000000ecee33066a6fd47200000000bc6fd4725a7e23b16cea33060000000050fa3306155e6976aae178c1feffffff75017276e2d8fd742824907002000000000000001800000030a5a470acee33062823be720000ff00000000000c00000030a5a470b8ee33062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310006a4e8330653a84c7308454d0600000000b0e8330648454c7308454d06f4e833068b3c4b7308454d062000000028121103c8e2270328121103c8e22703020000000000000018000000387d0c01f8e833062823be720000ff00000000000c000000c8e2270304e933062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310074e0910d0198cd050100000000e0910d011000000000000000c0e7330650dce676e0910d0110000000a4ce0b011c45b60510000000ece73306a6ec526e0200000000000000180000000832a470f0e733062823be720000ff00000000000c0000000832a470fce733062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000601000000e8e833066a6fd47200000000bc6fd472567823b168e433060000000050fa3306155e6976aae178c1feffffff75017276e2d8fd742824907002000000000000001800000030a5a470a8e833062823be720000ff00000000000c00000030a5a470b4e833062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007480c84c0698cd05010000000080c84c062000000000000000b0e8330650dce67680c84c0610000000dcb20b01ec50b60510000000dce83306a6ec526e0200000000000000180000000832a470e0e833062823be720000ff00000000000c0000000832a470ece833062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000601000000e4e933066a6fd47200000000bc6fd472527923b164e533060000000050fa3306155e6976aae178c1feffffff75017276e2d8fd742824907002000000000000001800000030a5a470a4e933062823be720000ff00000000000c00000030a5a470b0e933062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000058c84c06dce7330653a84c7358c84c0600000000e8e7330648454c7358c84c0628e833068b3c4b7358c84c062000000028121103f0192b032812110302000000000000001800000058c84c062ce833062823be720000ff00000000000c000000f0192b0338e833062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007480c84c0698cd05010000000080c84c06200000000000000088e8330650dce67680c84c0610000000dcb20b014451b60510000000b4e83306a6ec526e0200000000000000180000000832a470b8e833062823be720000ff00000000000c0000000832a470c4e833062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000601000000bce933066a6fd47200000000bc6fd4726a7923b13ce533060000000050fa3306155e6976aae178c1feffffff75017276e2d8fd742824907002000000000000001800000030a5a4707ce933062823be720000ff00000000000c00000030a5a47088e933062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f0c64c0694e7330653a84c73f0c64c0600000000a0e7330648454c73f0c64c06e0e733068b3c4b73f0c64c06200000002812110304d6430328121103020000000000000018000000f0c64c06e4e733062823be720000ff00000000000c00000004d64303f0e733062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007480c84c0698cd05010000000080c84c06200000000000000060e8330650dce67680c84c0610000000dcb20b019c52b605100000008ce83306a6ec526e0200000000000000180000000832a47090e833062823be720000ff00000000000c0000000832a4709ce833062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100060100000088e933066a6fd47200000000bc6fd472367923b108e533060000000050fa3306155e6976aae178c1feffffff75017276e2d8fd742824907002000000000000001800000030a5a47048e933062823be720000ff00000000000c00000030a5a47054e933062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000038ca4c0694e7330653a84c7338ca4c0600000000a0e7330648454c7338ca4c06e0e733068b3c4b7338ca4c0620000000281211030ce743032812110302000000000000001800000038ca4c06e4e733062823be720000ff00000000000c0000000ce74303f0e733062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007480c84c0698cd05010000000080c84c0620000000000000005ce8330650dce67680c84c0610000000dcb20b013c6ab6051000000088e83306a6ec526e0200000000000000180000000832a4708ce833062823be720000ff00000000000c0000000832a47098e833062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000008cd4c0694e7330653a84c7308cd4c0600000000a0e7330648454c7308cd4c06e0e733068b3c4b7308cd4c06200000002812110300f843032812110302000000000000001800000008cd4c06e4e733062823be720000ff00000000000c00000000f84303f0e733062f99a4700c000000 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000e8ce4c0694e7330653a84c73e8ce4c0600000000a0e7330648454c73e8ce4c06e0e733068b3c4b73e8ce4c062000000028121103301f440328121103020000000000000018000000e8ce4c06e4e733062823be720000ff00000000000c000000301f4403f0e733062f99a4700c000000 (UID: 00000000-00004068)2a:T75a,Found string "//settString.Replaceing[@name=\UString.Replacesername\]/vaString.Replaceluepath%appdata%\{0}\FileZilla\recentservers.xmlUser Data{0}\FileZilla\sitemanager.xml MB or SELECT * FROM CookiesconfigN" (Indicator: "select * from "; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "SELECT * FROM Win32_DiskDrive" (Indicator: "select * from "; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000000.66877.05B40000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp") Found string "SELECT * FROM AntiSpyWareProduct" (Indicator: "select * from "; Source: "00000000-00004068.00000001.68797.00FF0000.00000004.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp") Found string "SELECT * FROM Win32_D" (Indicator: "select * from "; Source: "00000000-00004068.00000001.68797.05D9C000.00000004.mdmp")2b:T4e2,"YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")2c:Tb88,"YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00004068-00000046-2157832 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00004068-00000046-4221369 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00004068-00000046-10236816902440038 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00004068-00000046-10236816902538815 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00004068-00000046-10236816902546263 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00004068-00000046-10236816902657957 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00004068-00000046-10236816902664442 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll" at 00000000-00004068-00000046-10236816903778117 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll" at 00000000-00004068-00000046-10236816903785915 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll" at 00000000-00004068-00000046-10236816903812850 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll" at 00000000-00004068-00000046-10236816903819348 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00004068-00000046-10236816904030668 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00004068-00000046-10236816904038815 "YoutubeAdvert.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00004068-00000046-102368169047780242d:T703,"YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION") "YoutubeAdvert.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3")2e:T4c2,"YoutubeAdvert.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004068)2f:T2e21,"YoutubeAdvert.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004068) "YoutubeAdvert.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004068)30:Tada,"SELECT * FROM Win32_DiskDrive" (Source: 00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000000.66877.05B40000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp, Indicator: "select * from win32_diskdrive") "SELECT Caption FROM Win32_OperatingSystem" (Source: 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM AntiSpyWareProduct" (Source: 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, Indicator: "select * from antispywareproduct") "SELECT * FROM Win32_OperatingSystem" (Source: 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "CREATE TABLE moz_cookies (id INTEGER PRIMARY KEY, baseDomain TEXT, originAttributes TEXT NOT NULL DEFAULT '', name TEXT, value TEXT, host TEXT, path TEXT, expiry INTEGER, lastAccessed INTEGER, creationTime INTEGER, isSecure INTEGER, isHttpOnly INTEGER, inBrowserElement INTEGER DEFAULT 0, CONSTRAINT moz_uniqueid UNIQUE (name, host, path, originAttributes))5" (Source: 00000000-00004068.00000001.68797.04110000.00000004.mdmp, 00000000-00004068.00000002.70716.04110000.00000004.mdmp, 00000000-00004068.00000003.76228.04110000.00000004.mdmp, Indicator: "create table moz_cookies (id integer primary key, basedomain text, originattributes text not null default '', name text, value text, host text, path text, expiry integer, lastaccessed integer, creationtime integer, issecure integer, ishttponly integer, inbrowserelement integer default 0, constraint moz_uniqueid unique (name, host, path, originattributes))5"), "SELECT * FROM Win32_VideoController" (Source: 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp, Indicator: "select * from win32_videocontroller"), "SELECT * FROM Win32_D" (Source: 00000000-00004068.00000001.68797.05D9C000.00000004.mdmp, Indicator: "select * from win32_d")31:T3434,Found reference to API (Indicator: "GetModuleHandleA"; File: "48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "ExtractAssociatedIcon"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SystemParametersInfo"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "OpenDesktop"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "EnumDesktopWindows"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetThreadDesktop"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetScrollPos"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProc"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "CreateDesktop"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004068.00000000.66877.005E4000.00000004.mdmp, 00000000-00004068.00000001.68797.005E4000.00000004.mdmp, 00000000-00004068.00000002.70716.005E4000.00000004.mdmp, 00000000-00004068.00000003.76228.005E4000.00000004.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp")32:T1e9d,"%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00004068-00000C27-10985934180 "%APPDATA%\Opera Software\*" in Source: 00000000-00004068-00000C27-29784586049 "sSecureSoftware\Valve\SteamROOT\SecurityCenterv10*ssfn*expiryname_on_cardSteamPath//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.Removeeencrypted_valueNWinordVWinpn.eWinxe*WinDisplayName\Program Files\\Program Files (x86)\profiles1*.1l1d1begram.exehost_keyAppData\Local\ProcessIdUnknownExtensionexpires_utcuser.config\Telegram Desktop\tdataAppData\Roaming\OpHandlerenVPHandlerN ConHandlernectName%USERPEnvironmentROFILE%\AppDEnvironmentata\RoaEnvironmentmingUNKNOWNOpera GXv11\Program Data\name{}:,[]".Profile_Unknownloginscookies.sqliteROOT\SecurityCenter2coMANGOokies.sqMANGOliteLocalPrefs.json\Windows\*.vstring.Replacedfexpiras21ation_moas21nth%DSK_23%TelTReplaceokReplaceenReplaces.tReplacextdisplayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost" in Source: 00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp, "\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock" in Source: 00000000-00004068.00000000.66877.00D80000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004068.00000000.66877.00D80000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C^^ID0" in Source: 00000000-00004068.00000000.66877.011AC000.00000004.mdmp, 00000000-00004068.00000001.68797.011AC000.00000004.mdmp, 00000000-00004068.00000002.70716.011AC000.00000004.mdmp, 00000000-00004068.00000003.76228.011AC000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Microsoft\WBE" in Source: 00000000-00004068.00000000.66877.011AC000.00000004.mdmp, 00000000-00004068.00000001.68797.011AC000.00000004.mdmp, 00000000-00004068.00000002.70716.011AC000.00000004.mdmp, 00000000-00004068.00000003.76228.011AC000.00000004.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004068.00000000.66877.03110000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004068.00000000.66877.03110000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004068.00000000.66877.03110000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004068.00000000.66877.03110000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00004068.00000000.66877.059FC000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node" in Source: 00000000-00004068.00000000.66877.059FC000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs" in Source: 00000000-00004068.00000000.66877.059FC000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "Software\Microsoft\RegEdt32" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004068.00000000.66877.7EFE0000.00000002.mdmp, 00000000-00004068.00000001.68797.7EFE0000.00000002.mdmp, 00000000-00004068.00000002.70716.7EFE0000.00000002.mdmp, 00000000-00004068.00000003.76228.7EFE0000.00000002.mdmp, "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cry" in Source: 00000000-00004068.00000001.68797.0008B000.00000004.mdmp, 00000000-00004068.00000001.68797.06FBC000.00000004.mdmp, 00000000-00004068.00000002.70716.0008B000.00000004.mdmp, 00000000-00004068.00000002.70716.05A7C000.00000004.mdmp, 00000000-00004068.00000003.76228.0008B000.00000004.mdmp, 00000000-00004068.00000003.76228.0541C000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Microsoft\Cryptography\DESHashSessionKeyBackward" in Source: 00000000-00004068.00000001.68797.0008B000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.06FBC000.00000004.mdmp, 00000000-00004068.00000002.70716.0008B000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.05A7C000.00000004.mdmp, 00000000-00004068.00000003.76228.0008B000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.0541C000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Cryptography\DESHashSessionKeyBackward" in Source: 00000000-00004068.00000001.68797.00D80000.00000004.mdmp 00000000-00004068.00000002.70716.00D80000.00000004.mdmp 00000000-00004068.00000003.76228.00D80000.00000004.mdmp33:T8e3,"YoutubeAdvert.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "YoutubeAdvert.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]34:T11ad,Found string "YoutubeAdvert" (Indicator: "dir "; Source: "00000000-00004068-00000BC0-27534048") Found string "YoutubeAdvert.exe" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.0017A000.00000004.mdmp, 00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000001.68797.0017A000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.0017A000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.0017A000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "C:\YoutubeAdvert.exe" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.0017A000.00000004.mdmp, 00000000-00004068.00000000.66877.001A0000.00000002.mdmp, 00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000000.66877.00FE0000.00000004.mdmp, 00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000001.68797.0017A000.00000004.mdmp, 00000000-00004068.00000001.68797.001A0000.00000002.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00FE0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.0017A000.00000004.mdmp, 00000000-00004068.00000002.70716.001A0000.00000002.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00FE0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.0017A000.00000004.mdmp, 00000000-00004068.00000003.76228.001A0000.00000002.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00FE0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string ""C:\YoutubeAdvert.exe"" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "ile:///C:/YoutubeAdvert.exe" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string ":\YoutubeAdvert.exe" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string ".0.30319\C:\YoutubeAdvert.exe" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string ":\YoutubeAdvert.exe.config" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "C:\YoutubeAdvert.exe.config" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "YoutubeAdvert.exe.config" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "YOUTUBE + ADVERT" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "file:///C:/YoutubeAdvert.exe" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "C:/YoutubeAdvert.exe" (Indicator: "dir "; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp")35:T1aec,"YoutubeAdvert.exe" loaded module "USER32.DLL" at base 762c0000 "YoutubeAdvert.exe" loaded module "ADVAPI32.DLL" at base 75d70000 "YoutubeAdvert.exe" loaded module "NTDLL.DLL" at base 77390000 "YoutubeAdvert.exe" loaded module "SHELL32.DLL" at base 750f0000 "YoutubeAdvert.exe" loaded module "SHLWAPI.DLL" at base 76760000 "YoutubeAdvert.exe" loaded module "MSCOREE.DLL" at base 73550000 "YoutubeAdvert.exe" loaded module "KERNEL32.DLL" at base 76cd0000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74270000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "YoutubeAdvert.exe" loaded module "KERNEL32" at base 76cd0000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "YoutubeAdvert.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "YoutubeAdvert.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "YoutubeAdvert.exe" loaded module "VERSION.DLL" at base 74a50000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "YoutubeAdvert.exe" loaded module "PSAPI.DLL" at base 74cf0000 "YoutubeAdvert.exe" loaded module "RPCRT4.DLL" at base 76670000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 73550000 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71770000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "YoutubeAdvert.exe" loaded module "OLE32.DLL" at base 74ea0000 "YoutubeAdvert.exe" loaded module "CRYPTBASE.DLL" at base 74c20000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 747a0000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 71760000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 716d0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70c70000 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6ee60000 "YoutubeAdvert.exe" loaded module "CRYPTSP.DLL" at base 74550000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74210000 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e6e0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "YoutubeAdvert.exe" loaded module "SECUR32.DLL" at base 74260000 "YoutubeAdvert.exe" loaded module "SSPICLI.DLL" at base 74c30000 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6e5b0000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76ee0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 70aa0000 "YoutubeAdvert.exe" loaded module "CLBCATQ.DLL" at base 74d50000 "YoutubeAdvert.exe" loaded module "OLEAUT32.DLL" at base 76e20000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 70a70000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 70a40000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 70900000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e510000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "YoutubeAdvert.exe" loaded module "BCRYPT.DLL" at base 6e4d0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6e3c0000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76ee0000 "YoutubeAdvert.exe" loaded module "PROFAPI.DLL" at base 768f0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "YoutubeAdvert.exe" loaded module "WS2_32.DLL" at base 76de0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73660000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 736d0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 736f0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WEBENGINE4.DLL" at base 6e250000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WEBENGINE4.DLL" at base 6e250000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "YoutubeAdvert.exe" loaded module "WEBENGINE4.DLL" at base 6e250000 "YoutubeAdvert.exe" loaded module "GDI32.DLL" at base 74df0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "YoutubeAdvert.exe" loaded module "ADVAPI32" at base 75d70000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74c90000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73400000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72c50000 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 70ac0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "YoutubeAdvert.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6ff00000 "YoutubeAdvert.exe" loaded module "RPCRTREMOTE.DLL" at base 74540000 "YoutubeAdvert.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76cd0000 "YoutubeAdvert.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 70a8000036:T45b,"150016003cba5373d4fa1800feec5173@ADVAPI32.dll" "0e000f00b4ba5373d4fa1800feec5173@ADVAPI32.dll" "0e000f00e8ba5373d4fa1800feec5173@ADVAPI32.dll" "1100120048bf5373d4fa1800feec5173@ADVAPI32.dll" "11001200b4bf5373d4fa1800feec5173@ADVAPI32.dll" "12001300c8bf5373d4fa1800feec5173@ADVAPI32.dll" "12001300f0bf5373d4fa1800feec5173@ADVAPI32.dll" "14001500b0d45373d4fa1800feec5173@ADVAPI32.dll" "14001500c8d45373d4fa1800feec5173@ADVAPI32.dll" "14001500e0d45373d4fa1800feec5173@ADVAPI32.dll" "17001800f8d45373d4fa1800feec5173@ADVAPI32.dll" "0d000e0010d55373d4fa1800feec5173@ADVAPI32.dll" "0d000e003cd65373d4fa1800feec5173@ADVAPI32.dll" "140015007cd65373d4fa1800feec5173@ADVAPI32.dll" "1400150094d65373d4fa1800feec5173@ADVAPI32.dll" "0c000d00dcd65373d4fa1800feec5173@ADVAPI32.dll" "0c000d00ecd65373d4fa1800feec5173@ADVAPI32.dll" "0e000f00fcd65373d4fa1800feec5173@ADVAPI32.dll" "1800190064d85373d4fa1800feec5173@RPCRT4.dll" "1300140090d85373d4fa1800feec5173@RPCRT4.dll" "14001500a4d85373d4fa1800feec5173@RPCRT4.dll" "16001700bcd85373d4fa1800feec5173@RPCRT4.dll" "0b000c0068d15373d4fa1800feec5173@WS2_32.dll"37:Tada,"SELECT * FROM Win32_DiskDrive" (Source: 00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000000.66877.05B40000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp, Indicator: "select * from win32_diskdrive") "SELECT Caption FROM Win32_OperatingSystem" (Source: 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM AntiSpyWareProduct" (Source: 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, Indicator: "select * from antispywareproduct") "SELECT * FROM Win32_OperatingSystem" (Source: 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "CREATE TABLE moz_cookies (id INTEGER PRIMARY KEY, baseDomain TEXT, originAttributes TEXT NOT NULL DEFAULT '', name TEXT, value TEXT, host TEXT, path TEXT, expiry INTEGER, lastAccessed INTEGER, creationTime INTEGER, isSecure INTEGER, isHttpOnly INTEGER, inBrowserElement INTEGER DEFAULT 0, CONSTRAINT moz_uniqueid UNIQUE (name, host, path, originAttributes))5" (Source: 00000000-00004068.00000001.68797.04110000.00000004.mdmp, 00000000-00004068.00000002.70716.04110000.00000004.mdmp, 00000000-00004068.00000003.76228.04110000.00000004.mdmp, Indicator: "create table moz_cookies (id integer primary key, basedomain text, originattributes text not null default '', name text, value text, host text, path text, expiry integer, lastaccessed integer, creationtime integer, issecure integer, ishttponly integer, inbrowserelement integer default 0, constraint moz_uniqueid unique (name, host, path, originattributes))5"), "SELECT * FROM Win32_VideoController" (Source: 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp, Indicator: "select * from win32_videocontroller"), "SELECT * FROM Win32_D" (Source: 00000000-00004068.00000001.68797.05D9C000.00000004.mdmp, Indicator: "select * from win32_d")38:T521,"YoutubeAdvert.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "YoutubeAdvert.exe" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\INPROCSERVER32") "YoutubeAdvert.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "YoutubeAdvert.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "YoutubeAdvert.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "YoutubeAdvert.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "YoutubeAdvert.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "YoutubeAdvert.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "YoutubeAdvert.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")39:T1dc8,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00004068-00000C24-26773201] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004068-00000C27-22067860608] Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00004068.00000000.66877.00010000.00000040.mdmp 00000000-00004068.00000000.66877.00300000.00000002.mdmp 00000000-00004068.00000001.68797.00010000.00000040.mdmp 00000000-00004068.00000001.68797.00300000.00000002.mdmp 00000000-00004068.00000002.70716.00010000.00000040.mdmp 00000000-00004068.00000002.70716.00300000.00000002.mdmp 00000000-00004068.00000003.76228.00010000.00000040.mdmp 00000000-00004068.00000003.76228.00300000.00000002.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00004068.00000000.66877.00020000.00000040.mdmp 00000000-00004068.00000000.66877.003B0000.00000002.mdmp 00000000-00004068.00000001.68797.00020000.00000040.mdmp 00000000-00004068.00000001.68797.003B0000.00000002.mdmp 00000000-00004068.00000002.70716.00020000.00000040.mdmp 00000000-00004068.00000002.70716.003B0000.00000002.mdmp 00000000-00004068.00000003.76228.00020000.00000040.mdmp 00000000-00004068.00000003.76228.003B0000.00000002.mdmp] Observed system executable string:"\??\C:\Windows\system32\uxtheme.dll" [Source: 00000000-00004068.00000000.66877.0008B000.00000004.mdmp 00000000-00004068.00000001.68797.0008B000.00000004.mdmp 00000000-00004068.00000002.70716.0008B000.00000004.mdmp 00000000-00004068.00000003.76228.0008B000.00000004.mdmp] Observed system executable string:"\??\C:\Windows\System32\wship6.dll" [Source: 00000000-00004068.00000000.66877.0008B000.00000004.mdmp] Observed system executable string:"C:\Windows\syswow64\ntdll.dll" [Source: 00000000-00004068.00000000.66877.0008B000.00000004.mdmp 00000000-00004068.00000001.68797.0008B000.00000004.mdmp 00000000-00004068.00000002.70716.0008B000.00000004.mdmp 00000000-00004068.00000003.76228.0008B000.00000004.mdmp] Observed system executable string:"C:\Windows\SYSTEM32\wow64.dll" [Source: 00000000-00004068.00000000.66877.0008B000.00000004.mdmp 00000000-00004068.00000001.68797.0008B000.00000004.mdmp 00000000-00004068.00000002.70716.0008B000.00000004.mdmp 00000000-00004068.00000003.76228.0008B000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\sxsoa.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\SysWOW64\sxsoa.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\GdiPlus.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\SysWOW64\GdiPlus.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\SysWOW64\comctl32.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoaps.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\SysWOW64\sxsoaps.dll" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll.mui" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\SysWOW64\comctl32.dll.mui" [Source: 00000000-00004068.00000000.66877.00190000.00000002.mdmp 00000000-00004068.00000001.68797.00190000.00000002.mdmp 00000000-00004068.00000002.70716.00190000.00000002.mdmp 00000000-00004068.00000003.76228.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004068.00000000.66877.001D0000.00000004.mdmp 00000000-00004068.00000001.68797.001D0000.00000004.mdmp 00000000-00004068.00000002.70716.001D0000.00000004.mdmp 00000000-00004068.00000003.76228.001D0000.00000004.mdmp] Observed system executable string:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll" [Source: 00000000-00004068.00000000.66877.00250000.00000004.mdmp 00000000-00004068.00000001.68797.00250000.00000004.mdmp 00000000-00004068.00000002.70716.00250000.00000004.mdmp 00000000-00004068.00000003.76228.00250000.00000004.mdmp] Observed system executable string:":\Windows\System32\fwpuclnt.dll" [Source: 00000000-00004068.00000000.66877.00D00000.00000004.mdmp 00000000-00004068.00000001.68797.00D00000.00000004.mdmp 00000000-00004068.00000002.70716.00D00000.00000004.mdmp 00000000-00004068.00000003.76228.00D00000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\ntdll.dll" [Source: 00000000-00004068.00000000.66877.00D80000.00000004.mdmp 00000000-00004068.00000001.68797.00D80000.00000004.mdmp 00000000-00004068.00000002.70716.00D80000.00000004.mdmp 00000000-00004068.00000003.76228.00D80000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\wow64win.dll" [Source: 00000000-00004068.00000000.66877.00D80000.00000004.mdmp 00000000-00004068.00000001.68797.00D80000.00000004.mdmp 00000000-00004068.00000002.70716.00D80000.00000004.mdmp 00000000-00004068.00000003.76228.00D80000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\wow64.dll" [Source: 00000000-00004068.00000000.66877.00D80000.00000004.mdmp 00000000-00004068.00000001.68797.00D80000.00000004.mdmp 00000000-00004068.00000002.70716.00D80000.00000004.mdmp 00000000-00004068.00000003.76228.00D80000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\wow64cpu.dll" [Source: 00000000-00004068.00000000.66877.00D80000.00000004.mdmp 00000000-00004068.00000001.68797.00D80000.00000004.mdmp 00000000-00004068.00000002.70716.00D80000.00000004.mdmp 00000000-00004068.00000003.76228.00D80000.00000004.mdmp]3a:T734,"YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: ""; Value: "")3b:T9a0,"YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "ENABLELUA"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "YOUTUBEADVERT"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000"; Key: "DRIVERDESC"; Value: "")3c:T6f7,"YoutubeAdvert.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\2ce9271c2b54eaf4a012ee351a9a514d\microsoft.csharp.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.security\34156ebd576361035e366c9ecc5f9bd7\system.security.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.management\e114780fd3ea5727401c06ea4f22ef35\system.management.ni.dll.aux" "YoutubeAdvert.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux"3d:T5fb,"YoutubeAdvert.exe" trying to touch file "C:\mscoree.dll" "YoutubeAdvert.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "YoutubeAdvert.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "YoutubeAdvert.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "YoutubeAdvert.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "YoutubeAdvert.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "YoutubeAdvert.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "YoutubeAdvert.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "YoutubeAdvert.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "YoutubeAdvert.exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" "YoutubeAdvert.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" "YoutubeAdvert.exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" "YoutubeAdvert.exe" trying to touch file "C:\Program Files\Mozilla Firefox\firefox.exe" "YoutubeAdvert.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Opera Software\" "YoutubeAdvert.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Thunderbird\" "YoutubeAdvert.exe" trying to touch file "C:\Windows\System32\wow64.dll"3e:T748,"YoutubeAdvert.exe" trying to access non-existent file "C:\mscoree.dll" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\FLTLIB.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL"3f:T93f,"YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Opera Software\" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Thunderbird\" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "YoutubeAdvert.exe" trying to access non-existent file "C:\YOUTUBEADVERT.EXE.CONFIG" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\E14ZE15RYTE" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\MICROSOFT.CSHARP.INI" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.SECURITY.INI" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAUTOMATIONCLIENT.INI" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAUTOMATIONTYPES.INI" "YoutubeAdvert.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.WEB.INI" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\YANDEX" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\BATTLE.NET" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\STEAM" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\WATERFOX" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\K-MELEON" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ATOMIC" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\EXODUS" "YoutubeAdvert.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ELECTRUM"40:T1ef2,Heuristic match: "1Z#.Sm" Heuristic match: "XZC.Fk" Heuristic match: "to.GU" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "www.sysinternals.com" Heuristic match: "s?.jP" Heuristic match: "O\.gA" Heuristic match: "6wv.TD" Heuristic match: "(ia Q`.vc" Heuristic match: "CU~.CC" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "dows.Fo" Heuristic match: "PATHEXT=.Cx" Heuristic match: "UsT.Us" Heuristic match: "rm.Se" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Pattern match: "https://pastebin.com/raw/V1mwGj8h" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "Microsoft.Net/assembly/GAC_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "my.visualstudio.com/[W" Pattern match: "MFlkQ1daWk9tSTRBQVFBQXBmeXFzYmZ2QkFzZ1hEUGVaNG1FZkxELzhGTUlGWk8rdWVFbHVacjVlOFg1NlpyR3lWU1J0QlVOUGNsZEhtZ01qazRncEsyUng1WnZZNmY4bkE2ZXhIMTN1cGc5OFIrU0Z2cTVLK01hTnVHNSs0RXF2SHlnRFVNVXJJU3V5N0NsNFo1bFZUaDdRWU93aUxvSm0zRG1TdUhHaHh3UWk1YmNINENzMlJkWi8zKy9NNEhx" Pattern match: ".microsoft.com/[M$" Pattern match: "app.vsaex.visualstudio.com/[W" Pattern match: "MFlkQ1daWk9tSTRBQVFBQVlhWXZCbHpVQ2VPbzh5dndmdzhEbG1PTUc1TFpocGJaSUxEQ2hPZVJneE83ZjNrb1ZZZlNEMDY5UGJiMmFGN2ROek50NVJqL1pPdUJDcUtiM2VjS2hCblJlcDBleXVyOWNrd1lQNi9PTTNEYm9rVHdmaDJqbW5VdjltVGc3d29ETXRYOHlTQnpzWUs1aU4wejJkS040TzQ5UWZObjdCeUJwV212NTZiTkhSNlE2dElC" Pattern match: "app.vssps.visualstudio.com/[W" Pattern match: "MFlkQ1daWk9tSTRBQVFBQUJNejBoZnNEd0M4QUZZQlM1Q2J4aW03Sm1wTVFTWXBsdWNJMmx4T2NQV29pV212T2h6MW1zeHF4eWpXclcvVkhsb3VsM3lkaG5DZzM0Uy85SG45TVlqZ3BjT1Z0N0xkZHovVVF0RWozQys5azJXTEkxc0RXeW84NWg1Q1BBZ0RYNlJZWVl3YzlDQUpEQVBQTkZRdy9uTTlqUFEvWnhXaXNGcE1wdVY1RHBZYkVYb0lT" Pattern match: "microsoftonline.comCCStateQ3VjRENrUnRZWEpqTG5KcGRtVnliMEJqY205M1pITjBjbWxyWlM1amIyMThZWEJ3T2pRNU9XSTROR0ZqTFRFek1qRXROREkzWmkxaFlURTNMVEkyTjJOaE5qazNOVGM1T0JLVEF6Q0NBWThHQ1NxR1NJYjNEUUVIQTZDQ0FZQXdnZ0Y4QWdFQU1ZSUJTRENDQVVRQ0FRQXdMREFWTVJNd0VRWURWUVFERXdwTl" Pattern match: "-eSn5QgRFXAUSj3Hd-QpHYZnCv8zMRPxWl4aNZcbaetFvlLZvLb-XqeNWcgAAlogin.microsoftonline.com/[ua" Pattern match: "rzcL7PalHfeiEHHIY6J0DrClYM2ad1VHQnX5h1Sx3F5beOO4EPYnLyavj3D23sZWw1crowdstrike.okta.com/]/" Pattern match: "crowdstrike.okta.com/[M$" Pattern match: "okta.comoktaStateToken00KHowXBlaa-LfBPJr5no2Y1vLEtSXXBPL6fGtV5Vacrowdstrike.okta.com/[M%" Pattern match: "-01-03-16.google.com/\U" Pattern match: "False.visualstudio.com/[W" Pattern match: ".2.494341844.1548851845.microsoft.com/\R" Pattern match: "1531827285897visualstudio.microsoft.com/]/" Pattern match: "1531827285897.microsoft.com/]/" Pattern match: "7D.visualstudio.com/dV" Pattern match: ".microsoft.com/\y" Pattern match: "google.com/\U" Pattern match: ".google.com/[M" Pattern match: ".google.com/verify\;O" Pattern match: "google.comCGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA.google.com/search\" Pattern match: "google.comCGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA.google.com/complete/search\" Pattern match: ".microsoft.com/\QY" Pattern match: "google.com/[o" Pattern match: "-36116321-11.mozilla.org/Z%" Pattern match: ".2.1613423979.1512412239.mozilla.org/Z&5" Pattern match: ".2.347333463.1512412239.mozilla.org/]7"41:T5b8,Found string "+ncalrpc:[OLE0C5346D477774889A8503703FD3C]" (Indicator: "ncalrpc"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "+ncalrpc:[OLECC44B33222164B9E9AD96A81542C]" (Indicator: "ncalrpc"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "B+ncalrpc:[OLECC44B33222164B9E9AD96A81542C]" (Indicator: "ncalrpc"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.064C0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.064C0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.064C0000.00000004.mdmp")42:Ta10,"YoutubeAdvert.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004068) "YoutubeAdvert.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004068)43:T214b,Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found string "High 128-bit AES (Acrobat 7.0 and up)" (Indicator: "aes"; Source: "00000000-00004068.00000000.66877.00479000.00000002.mdmp, 00000000-00004068.00000001.68797.00479000.00000002.mdmp, 00000000-00004068.00000002.70716.00479000.00000002.mdmp, 00000000-00004068.00000003.76228.00479000.00000002.mdmp") Found string "High 256-bit AES (Acrobat 9.0 and up)" (Indicator: "aes"; Source: "00000000-00004068.00000000.66877.00479000.00000002.mdmp, 00000000-00004068.00000001.68797.00479000.00000002.mdmp, 00000000-00004068.00000002.70716.00479000.00000002.mdmp, 00000000-00004068.00000003.76228.00479000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004068.00000000.66877.03110000.00000004.mdmp")44:T57b,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004068.00000000.66877.005E4000.00000004.mdmp, 00000000-00004068.00000001.68797.005E4000.00000004.mdmp, 00000000-00004068.00000002.70716.005E4000.00000004.mdmp, 00000000-00004068.00000003.76228.005E4000.00000004.mdmp")45:T635,Found string "SELECT * FROM Win32_DiskDrive" (Indicator: " Win32_DiskDrive"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000000.66877.05B40000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp")46:T3da8,Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ACPI.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ACPI.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WMILIB.SYS" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WMILIB.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msisadrv.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msisadrv.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\pci.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\pci.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vdrvroot.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vdrvroot.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "em32\drivers\partmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\compbatt.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\compbatt.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\BATTC.SYS" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\BATTC.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\volmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\volmgr.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\volmgrx.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\volmgrx.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\mountmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\mountmgr.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\atapi.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\atapi.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ataport.SYS" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ataport.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msahci.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msahci.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\PCIIDEX.SYS" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\PCIIDEX.SYS" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\amdxata.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\amdxata.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fltmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fltmgr.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fileinfo.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fileinfo.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\Ntfs.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\Ntfs.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\msrpc.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\msrpc.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\ksecdd.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\ksecdd.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\cng.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\cng.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\VBoxGuest.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\VBoxGuest.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\pcw.sys" (Indicator: "\drivers\"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\pcw.sys" (Indicator: "system32\drivers"; Source: "00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp")47:Ta00,"YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "YoutubeAdvert.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")48:T601,"SELECT * FROM Win32_DiskDrive" (Indicator: " win32_diskdrive"; Source: "00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000000.66877.05B40000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp") "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp") "SELECT * FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp") "SELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp")49:T55c,"GetModuleHandleExW@KERNEL32.DLL" in "YoutubeAdvert.exe" "LoadLibraryW@KERNEL32.DLL" in "YoutubeAdvert.exe" "GetModuleHandleA@KERNEL32.DLL" in "YoutubeAdvert.exe" "GetFileSizeEx@KERNEL32.DLL" in "YoutubeAdvert.exe" "LoadLibraryExW@KERNELBASE.DLL" in "YoutubeAdvert.exe" "GetFileType@KERNELBASE.DLL" in "YoutubeAdvert.exe" "LoadLibraryExA@KERNELBASE.DLL" in "YoutubeAdvert.exe" "GetModuleHandleExA@KERNELBASE.DLL" in "YoutubeAdvert.exe" "CreateFileMappingW@KERNEL32.DLL" in "YoutubeAdvert.exe" "GetModuleHandleExA@KERNEL32.DLL" in "YoutubeAdvert.exe" "CreateFileMappingW@KERNELBASE.DLL" in "YoutubeAdvert.exe" "CreateFileW@KERNELBASE.DLL" in "YoutubeAdvert.exe" "GetModuleHandleW@KERNELBASE.DLL" in "YoutubeAdvert.exe" "GetModuleHandleW@KERNEL32.DLL" in "YoutubeAdvert.exe" "GetFileType@KERNEL32.DLL" in "YoutubeAdvert.exe" "OpenFile@KERNEL32.DLL" in "YoutubeAdvert.exe" "GetFileSizeEx@KERNELBASE.DLL" in "YoutubeAdvert.exe" "CreateFileA@KERNEL32.DLL" in "YoutubeAdvert.exe" "CreateFileMappingA@KERNEL32.DLL" in "YoutubeAdvert.exe" "GetModuleHandleExW@KERNELBASE.DLL" in "YoutubeAdvert.exe" "ReadFile@KERNELBASE.DLL" in "YoutubeAdvert.exe" "GetFileSize@KERNEL32.DLL" in "YoutubeAdvert.exe" "GetModuleHandleA@KERNELBASE.DLL" in "YoutubeAdvert.exe" "CreateFileW@KERNEL32.DLL" in "YoutubeAdvert.exe" "LoadLibraryExW@KERNEL32.DLL" in "YoutubeAdvert.exe"4a:Tb10,"YoutubeAdvert.exe" wrote bytes "e91177a089" to virtual address "0x76CE4A0F" ("GetModuleHandleExW@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9e36d9f89" to virtual address "0x76CE48CB" ("LoadLibraryW@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "711114017a3b1301ab8b02007f950200fc8c0200729602006cc805001ecd10017d261001" to virtual address "0x762D07E4" (part of module "USER32.DLL") "YoutubeAdvert.exe" wrote bytes "e968f99c89" to virtual address "0x76CE1245" ("GetModuleHandleA@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9a10d9289" to virtual address "0x76CE5982" ("GetFileSizeEx@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9b5dc9e8b" to virtual address "0x74D12BDC" ("LoadLibraryExW@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e95f8d948b" to virtual address "0x74D0DC9E" ("GetFileType@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e914ee998b" to virtual address "0x74D12E40" ("LoadLibraryExA@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e9d6ba9d8b" to virtual address "0x74D11E85" ("GetModuleHandleExA@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e966da9489" to virtual address "0x76CE18D9" ("CreateFileMappingW@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9c30e9f89" to virtual address "0x76CFCA98" ("GetModuleHandleExA@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9f409928b" to virtual address "0x74D0E94B" ("CreateFileMappingW@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e9fa4b9b8b" to virtual address "0x74D1C40D" ("CreateFileW@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e9a49e988b" to virtual address "0x74D11E4C" ("GetModuleHandleW@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e9a0889b89" to virtual address "0x76CE3450" ("GetModuleHandleW@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e92c359789" to virtual address "0x76CE34D1" ("GetFileType@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9258f9b89" to virtual address "0x76CFA2EF" ("OpenFile@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9ae978f8b" to virtual address "0x74D0CF75" ("GetFileSizeEx@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e92ab6a389" to virtual address "0x76CE5366" ("CreateFileA@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e917ec9f89" to virtual address "0x76CE54A6" ("CreateFileMappingA@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e926a29d8b" to virtual address "0x74D11EFA" ("GetModuleHandleExW@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e9f5fb9d8b" to virtual address "0x74D0DD7D" ("ReadFile@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e99511a089" to virtual address "0x76CE193E" ("GetFileSize@KERNEL32.DLL") "YoutubeAdvert.exe" wrote bytes "e9ccdb998b" to virtual address "0x74D12FE1" ("GetModuleHandleA@KERNELBASE.DLL") "YoutubeAdvert.exe" wrote bytes "e90bd19e89" to virtual address "0x76CE3EFC" ("CreateFileW@KERNEL32.DLL")4b:T149f,"YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Yandex\YANDEXBROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMODO\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CRYPTOTAB BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\fg6ygf16.default\cookies.sqlite" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\CKPAELOCNIGGKHEIBCACECNMMLMEODFA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\CKPAELOCNIGGKHEIBCACECNMMLMEODFA" "YoutubeAdvert.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\K-Meleon\" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\MAPLESTUDIO\CHROMEPLUS\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\IRIDIUM\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\7STAR\7STAR\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\CENTBROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\CHEDOT\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\VIVALDI\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\KOMETA\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\ELEMENTS BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\EPIC PRIVACY BROWSER\USER DATA" "YoutubeAdvert.exe" trying to open a file "%LOCALAPPDATA%\UCOZMEDIA\URAN\USER DATA"4c:T8b0,YoutubeAdvert.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask YoutubeAdvert.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet YoutubeAdvert.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink YoutubeAdvert.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask YoutubeAdvert.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet YoutubeAdvert.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink YoutubeAdvert.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask YoutubeAdvert.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet YoutubeAdvert.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\DEFAULT\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink YoutubeAdvert.exe trying to open a file %LOCALAPPDATA%\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask YoutubeAdvert.exe trying to open a file %LOCALAPPDATA%\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet YoutubeAdvert.exe trying to open a file %LOCALAPPDATA%\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink4d:T5b1,Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000001.69475.063B0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.063B0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.063B0000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000001.69475.063B0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.063B0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.063B0000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000001.69475.063B0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.063B0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.063B0000.00000004.mdmp")4e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4h3eIcAAAAAAAAAAAAAAIh2ZmZnhwAAAAAAAAAAAAh2ZmZmZmhwAAAAAAZmZmSHZmZmZmZmdwAAAABmZmZodmZ3Zmd2ZmgAAAAEZ3ZmaGZmeGZohmZngAAABnd2ZndmZnh2aIZmZocAAAZnd3eGZmZ4dmiGZmZ3AAAGZ3d3hmZmaIeIhmZmeAAABnd3d4ZmZm///4ZmZngAAAZ4d3eGZmZv92j/ZmZ4AAAGeHd2hmZuaPjm/2ZmePAAB4h2ZndmZmj4aP92ZocAAAeIZmZoZmZn////ZmeAAAAHiGZmaHZ3iP//iIdojwAAB4hmZmaGaIiIiIiGeAAAAAeI5m7u6HaIh3iIZ4cAAAAHiHZu7u6HZ3u3ZohwAAAAB4h3ZmZmaIg7t3iAAAAAAAaIeIiId3dnO4dzcAAAAAAHeIiIiIiHd3N3B3AAAAAAiHeIiIiIiHdzdwAAAAAAAIh2Znd4iIiIc3NwAAAAAACGZ3dmZmZkRDNzMAAAAAAABmZ3d3d3dmY3cwAAAAAAAAeId3d3d2ZmJ3cAAAAAAAB4iIiIiIiHd3czAAAAAAAAiIiIiIiIiIhzMAAAAAAAAAAAAAAP/4iIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8AAAA8AAAAOAAAADgAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAAOAAAADgAAAA4AAAAP8AAAH/AAAB/4AAA//gAB//4AH//w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790320977885,"unified_at":"2026-09-25T07:22:57.885Z","metadata":{"hashes":{"sha256":"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e","sha1":"a0812e84e6c423b55c771ad05695cff5e20b37e7","md5":"4509256a05f0d4090c11f2d424a33529","sha512":"c9ffceb1bb74b7953216af6a6799959386185b9b29d17013956706192b614e581fef2643f84ecfd2844f9ae0ea696aef72bc45198384c74100272581fc08fd1d","ssdeep":"98304:UPmS8VELAMoLmnXETJkK6rcfC9kUAm6yK6u:M8VwAM4cElkK6oskUA9","ssdeep_chunks":["98304:UPmS8VE","98304:PmS8VEL","98304:mS8VELA","98304:S8VELAM","98304:8VELAMo","98304:VELAMoL","98304:ELAMoLm","98304:LAMoLmn","98304:AMoLmnX","98304:MoLmnXE","98304:oLmnXET","98304:LmnXETJ","98304:mnXETJk","98304:nXETJkK","98304:XETJkK6","98304:ETJkK6r","98304:TJkK6rc","98304:JkK6rcf","98304:kK6rcfC","98304:K6rcfC9","98304:6rcfC9k","98304:rcfC9kU","98304:cfC9kUA","98304:fC9kUAm","98304:C9kUAm6","98304:9kUAm6y","98304:kUAm6yK","98304:UAm6yK6","98304:Am6yK6u","196608:UPmS8VE","196608:PmS8VEL","196608:mS8VELA","196608:S8VELAM","196608:8VELAMo","196608:VELAMoL","196608:ELAMoLm","196608:LAMoLmn","196608:AMoLmnX","196608:MoLmnXE","196608:oLmnXET","196608:LmnXETJ","196608:mnXETJk","196608:nXETJkK","196608:XETJkK6","196608:ETJkK6r","196608:TJkK6rc","196608:JkK6rcf","196608:kK6rcfC","196608:K6rcfC9","196608:6rcfC9k","196608:rcfC9kU","196608:cfC9kUA","196608:fC9kUAm","196608:C9kUAm6","196608:9kUAm6y","196608:kUAm6yK","196608:UAm6yK6","196608:Am6yK6u","98304:M8VwAM4","98304:8VwAM4c","98304:VwAM4cE","98304:wAM4cEl","98304:AM4cElk","98304:M4cElkK","98304:4cElkK6","98304:cElkK6o","98304:ElkK6os","98304:lkK6osk","98304:kK6oskU","98304:K6oskUA","98304:6oskUA9"],"imphash":"4328f7206db519cd4e82283211d98e83"},"file_info":{"file_name":"YoutubeAdvert.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3467264,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1686729656000,"last_seen":1686729657000,"last_multi_scan":1686729657000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","evasive"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":121,"suspicious_count":21,"malicious_count":12,"total":154},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Convagent.trYj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Sabsik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/RedLine.eiaqr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.67453879","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.67453879 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.CFCTVGY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a6ee21 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-PSW.MSIL.Reline.syz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Gen-Crypt.ccnc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.UVST-7599","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks key cryptographic functions of the CryptoAPI"},{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"suspicious","value":"Read windows product name from registry"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Observed security product related strings in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries list of installed browsers"},{"type":"informative","value":"May execute SQL queries"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"malicious","value":"Found transport agent related strings used by exchange malware"}],"sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004068.00000000.66877.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004068.00000001.68797.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004068.00000002.70716.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004068.00000003.76228.00400000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string - \\.\\pipe\\hhgo1JrrL4Y75kNtdxw2nkHnfgsYNVfsB8Pxoxf3jgMTzNh17H7XfWNsAxTuBtKGRNVEsNqqUVUA9f3n4P1MgVC4xncXb67MDH4SbdlbLkK4efOmcMAUiO; Source: \"00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".themida\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor al\n 85h in Stream UID: 00000000-00004068-26628-1-00477DDE\n Assembly shows XOR instruction xor byte ptr [ebx]\n al in Stream UID: 00000000-00004068-26628-1-00477DDE\n Assembly shows XOR instruction xor byte ptr [00004400h]\n al in Stream UID: 00000000-00004068-26628-1-00477DDE\n Assembly shows XOR instruction xor byte ptr [edi]\n al in Stream UID: 00000000-00004068-26628-1-00477DDE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"iption=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004068.00000000.66877.00FF0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.948202492331392","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"YoutubeAdvert.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"YoutubeAdvert.exe\" called \"IsWow64Process\" with parameter \"4068\" - (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"IsWow64Process\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"YoutubeAdvert.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"YoutubeAdvert.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"YoutubeAdvert.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"LookupAccountSidW\" with param Name Administrators (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"LookupAccountSidW\" with param Name Performance Log Users (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"LookupAccountSidW\" with param Name Performance Monitor Users (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"YoutubeAdvert.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"YoutubeAdvert.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetMonitorInfo\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")\n Found reference to API \"FindWindow\" (Indicator: \"FindWindow\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"YoutubeAdvert.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve disk information","description":"Found string \"SELECT * FROM Win32_DiskDrive\" (Indicator: \" Win32_DiskDrive\"; Source: \"00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp, 00000000-00004068.00000000.66877.05B40000.00000004.mdmp, 00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000001.68797.05B40000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.05B40000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.05B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-514","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"YoutubeAdvert.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Yandex (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Yandex\\YaAddon (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"95.143.190.57:15647\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$30","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004068-00000456-10236816901476845\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004068-00000456-10236816901477162\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004068-00000456-10236816901508031\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00004068.00000000.66877.03110000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$34","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\.\\pipe\\hhgo1JrrL4Y75kNtdxw2nkHnfgsYNVfsB8Pxoxf3jgMTzNh17H7XfWNsAxTuBtKGRNVEsNqqUVUA9f3n4P1MgVC4xncXb67MDH4SbdlbLkK4efOmcMAUiO","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"YoutubeAdvert.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71770000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"YoutubeAdvert.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 6E4D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"YoutubeAdvert.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 724A0000\n \"YoutubeAdvert.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72C50000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"YoutubeAdvert.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76670000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" was detected as \"Themida/Winlicense\" and name: \"Protector\"\n \"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" has an executable section named \"\"\n \"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" has an executable section named \".themida\"\n \"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" has an executable section named \".boot\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" has an writable section named \".idata\"\n \"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" has an writable section named \".themida\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" file has an entrypoint instructions - \"call\t0x988ba0,push\tebx,mov\tebx, esp,push\tebx,mov\tesi, dword ptr [ebx + 8],mov\tedi, dword ptr [ebx + 0x10],cld\t,mov\tdl, 0x80,mov\tal, byte ptr [esi],inc\tesi,mov\tbyte ptr [edi], al,inc\tedi,mov\tebx, 2,add\tdl, dl,jne\t0x988a76,mov\tdl, byte ptr [esi],inc\tesi,adc\tdl, dl,jae\t0x988a62,add\tdl, dl,jne\t0x988a81,mov\tdl, byte ptr [esi],inc\tesi,adc\tdl, dl,jae\t0x988ad4,xor\teax, eax,add\tdl, dl,jne\t0x988a8e,mov\tdl, byte ptr [esi],inc\tesi,adc\tdl, dl,jae\t0x988b75,add\tdl, dl,jne\t0x988a9d,mov\tdl, byte ptr [esi],inc\tesi,adc\tdl, dl,adc\teax, eax,add\tdl, dl,jne\t0x988aa8,mov\tdl, byte ptr [esi],inc\tesi,adc\tdl, dl,adc\teax, eax,add\tdl, dl,jne\t0x988ab3,mov\tdl, byte ptr [esi],inc\tesi,adc\tdl, dl,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".boot\" is \"0x203600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x168e7c\" greater than 0x100000\n Virtual size of \".themida\" is \"0x384000\" greater than 0x100000\n Virtual size of \".boot\" is \"0x203600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"YoutubeAdvert.exe\" searching for class \"OLLYDBG\"\n \"YoutubeAdvert.exe\" searching for class \"GBDYLLO\"\n \"YoutubeAdvert.exe\" searching for class \"pediy06\"\n \"YoutubeAdvert.exe\" searching for class \"FilemonClass\"\n \"YoutubeAdvert.exe\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"YoutubeAdvert.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"YoutubeAdvert.exe\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"YoutubeAdvert.exe\" searching for class \"RegmonClass\"\n \"YoutubeAdvert.exe\" searching for class \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"YoutubeAdvert.exe\" searching for class \"18467-41\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 1657216)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"YoutubeAdvert.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"YoutubeAdvert.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"YoutubeAdvert.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"YoutubeAdvert.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"YoutubeAdvert.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"YoutubeAdvert.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"YoutubeAdvert.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"YoutubeAdvert.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"YoutubeAdvert.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktop\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"YoutubeAdvert.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"YoutubeAdvert.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"YoutubeAdvert.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}\n \"YoutubeAdvert.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"YoutubeAdvert.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"10c39f8\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004068.00000000.66877.005E4000.00000004.mdmp, 00000000-00004068.00000001.68797.005E4000.00000004.mdmp, 00000000-00004068.00000002.70716.005E4000.00000004.mdmp, 00000000-00004068.00000003.76228.005E4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00004068.00000000.66877.00FF0000.00000004.mdmp, 00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"CK>80, 925, 5, 5, 50, 21, 1100, 21\" (Indicator: \"\"; File: \"00000000-00004068.00000003.76228.00400000.00000002.mdmp\")\n Found string \"\" (Indicator: \"\"; Source: \"00000000-00004068.00000000.66877.00479000.00000002.mdmp, 00000000-00004068.00000001.68797.00479000.00000002.mdmp, 00000000-00004068.00000002.70716.00479000.00000002.mdmp, 00000000-00004068.00000003.76228.00479000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Observed security product related strings in binary/memory","description":"Found string -okta.comproximity_0371cacd3c86c11110ce4a7c15c77e19AMZGnO6o/2MBiNoUnYqDF4QuXiAX2tjRZ3EZEWkyQNBJpqvois7unYHbEn9CQk1aOYNbsVnyfDmWAQmNMbpYE/P7Z/YTvYgSuOeMKhGJfrgNqizORo0U8rhOeq84D+rzcL7PalHfeiEHHIY6J0DrClYM2ad1VHQnX5h1Sx3F5beOO4EPYnLyavj3D23sZWw1crowdstrike.okta.com/]/\n Found string -okta.comADRUM_BTa\"R:50|g:4281e54b-1357-42e8-a466-e9559a6670f5|n:Okta_6d5b1e30-d05a-4894-a37b-81b5f6c60e0e\"crowdstrike.okta.com/[M$\n Found string -okta.comDTDI0biejDDkhRHOZHV5aWUgQqAcrowdstrike.okta.com/_\n Found string -okta.comoktaStateToken00KHowXBlaa-LfBPJr5no2Y1vLEtSXXBPL6fGtV5Vacrowdstrike.okta.com/[M%\n Found string -okta.comADRUM_BT1\"R:50|i:11276|e:57\"crowdstrike.okta.com/[M$","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-123","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"YoutubeAdvert.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$46","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004068.00000000.66877.00402000.00000020.mdmp, 00000000-00004068.00000001.68797.00402000.00000020.mdmp, 00000000-00004068.00000002.70716.00402000.00000020.mdmp, 00000000-00004068.00000003.76228.00402000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004068.00000000.66877.00402000.00000020.mdmp\n 00000000-00004068.00000001.68797.00402000.00000020.mdmp\n 00000000-00004068.00000002.70716.00402000.00000020.mdmp\n 00000000-00004068.00000003.76228.00402000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"YoutubeAdvert.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"HHGO1JRRL4Y75KNTDXW2NKHNFGSYNVFSB8PXOXF3JGMTZNH17H7XFWNSAXTUBTKGRNVESNQQUVUA9F3N4P1MGVC4XNCXB67MDH4SBDLBLKK4EFOMCMAUIO\"; Value: \"E40F0000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"YoutubeAdvert.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,services.exe,lsm.exe,svchost.exe\" (Source: \"00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"???\n ???\n .boot with unusual entropies 7.99198795722\n 7.95374105214\n 7.95472583517","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"YoutubeAdvert.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$48","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"YoutubeAdvert.exe\" (Thread ID: 4088) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"YoutubeAdvert.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"54/70 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.1.2\"\n \"4.0.0.1\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0, Culture=neutral, Publi\"\n \"1.0.0.0\"\n \"192.168.242.0\"\n Potential IP \"4.5.9.0\" found in string \"rsion=4.5.9.0, Culture=neutral, PublicKeyToken=t\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0, Cul\"\n \"95.143.190.57\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culo\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\n Potential IP \"64.124.12.162\" found in string \"duosecurity.comhac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O|64.124.12.162|1531827384|f8ebba7738cc5c7d5d59dbabd3fb83b8ae8da71dapi-81556a20.duosecurity.com/\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\YoutubeAdvert.exe\" connects to 95.143.190.57 on port 15647 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004068.00000000.66877.00D80000.00000004.mdmp, 00000000-00004068.00000001.68797.00D80000.00000004.mdmp, 00000000-00004068.00000002.70716.00D80000.00000004.mdmp, 00000000-00004068.00000003.76228.00D80000.00000004.mdmp\")\n Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004068.00000000.66877.03110000.00000004.mdmp\")\n Found string \"PIPE_EVENTROOT\\CIMV2SCM EVENT PROVIDER\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004068.00000001.68797.00FF0000.00000004.mdmp, 00000000-00004068.00000002.70716.00FF0000.00000004.mdmp, 00000000-00004068.00000003.76228.00FF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"YoutubeAdvert.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00004068)\n \"YoutubeAdvert.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"YoutubeAdvert.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"nt service\\\\remoteregistry\"\n \"Sid\": \"0\"\n \"cbSid\": \"20000000\"\n \"cchReferencedDomainName\": \"0b000000\"\n \"peUse\": \"00000000\"}\n \"YoutubeAdvert.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"nt service\\\\remoteregistry\"\n \"Sid\": \"17606752\"\n \"cbSid\": \"20000000\"\n \"ReferencedDomainName\": \"NT SERVICE\"\n \"cchReferencedDomainName\": \"0a000000\"\n \"peUse\": \"05000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"YoutubeAdvert.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Local\\NICHROME\\USER DATA\"\n \"YoutubeAdvert.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"YoutubeAdvert.exe\" opened file \"%LOCALAPPDATA%\\NICHROME\\USER DATA\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"YoutubeAdvert.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"YoutubeAdvert.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Thunderbird\\\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"$49","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"YoutubeAdvert.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\ASP.NET_4.0.30319\\NAMES\"; Key: \"HHGO1JRRL4Y75KNTDXW2NKHNFGSYNVFSB8PXOXF3JGMTZNH17H7XFWNSAXTUBTKGRNVESNQQUVUA9F3N4P1MGVC4XNCXB67MDH4SBDLBLKK4EFOMCMAUIO\"; Value: \"E40F0000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e.bin\" has an entrypoint in section \".boot\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$4a","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"YoutubeAdvert.exe\" at 00000000-00004068-00000033-10236816901504028\n \"YoutubeAdvert.exe\" at 00000000-00004068-00000033-10236816901504235","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"YoutubeAdvert.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"YoutubeAdvert.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"VMware trick\" in \"sample.bin\" (Offset: 3044806)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Arechclient2 Backdoor CnC Init\" (SID: 2029217, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"54/70 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 95.143.190.57 on port 15647","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$4b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$4c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004032.00000000.67552.02760000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004032.00000000.67552.02760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000001.69475.063B0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.063B0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.063B0000.00000004.mdmp\")\n Found reference to API \"ions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004032.00000001.69475.05720000.00000004.mdmp, 00000000-00004032.00000002.71395.05720000.00000004.mdmp, 00000000-00004032.00000003.76907.05720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"Win32API|Device Input and Output Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004032.00000000.67552.04FE0000.00000004.mdmp, 00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000001.69475.063B0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.063B0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.063B0000.00000004.mdmp\")\n Found reference to API \"ions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"24794350201,3808,9,$name,2,0,,\"Outlook.pst\"\" (Indicator: \".pst\") in Source: 00000000-00004032.00000001.69475.05720000.00000004.mdmp\n 00000000-00004032.00000002.71395.05720000.00000004.mdmp\n 00000000-00004032.00000003.76907.05720000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"INDEX.BTR\" has type \"data\"- [targetUID: 00000000-00004032]\n \"MAPPING1.MAP\" has type \"DIY-Thermocam raw data (Lepton 2.x) scale 38401-0 spot sensor temperature 0.000000 unit celsius color scheme 0 calibration: offset 0.000000 slope 2251800350556160.000000\"- [targetUID: 00000000-00004032]\n \"MAPPING2.MAP\" has type \"DIY-Thermocam raw data (Lepton 2.x) scale 38401-0 spot sensor temperature 0.000000 unit celsius color scheme 0 calibration: offset 0.000000 slope 2251800350556160.000000\"- [targetUID: 00000000-00004032]\n \"MAPPING3.MAP\" has type \"DIY-Thermocam raw data (Lepton 2.x) scale 38401-0 spot sensor temperature 0.000000 unit celsius color scheme 0 calibration: offset 0.000000 slope 2251800350556160.000000\"- [targetUID: 00000000-00004032]\n \"RecentFileCache.bcf\" has type \"data\"- [targetUID: 00000000-00004032]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000001.69475.063B0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.063B0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.063B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"4,3185,,LookupAccountSidW,advapi32.dll,\"252:03:07.390\",RX=0,PX=0\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00004032.00000000.67552.00210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004032-00000C27-24789791195\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*.txt\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004032-00000C27-24796627773\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*.doc*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004032-00000C27-24798430043\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*key*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004032-00000C27-24800236374\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*wallet*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004032-00000C27-24802079266\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*seed*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004032-00000C27-24804581131\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Login Data, CommandLine: , Name: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall-*.lo--gNoDefrdDefVPNDefID: CommandLineOpera GX Stabletdata\\tdataZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00004032.00000000.67552.00402000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00004032-00000C27-21903338804\")\n \"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00004032-00000C27-18446744054523620872\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"YoutubeAdvert.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004032)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004032.00000001.69475.04FE0000.00000004.mdmp, 00000000-00004032.00000002.71395.04FE0000.00000004.mdmp, 00000000-00004032.00000003.76907.04FE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"YoutubeAdvert.exe\" at 00000000-00004032-00000105-10074682710322625","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"YoutubeAdvert.exe\" queried SystemProcessInformation at 00000000-00004032-00000105-13412153 [PID: 4032]\n \"YoutubeAdvert.exe\" queried SystemProcessInformation at 00000000-00004032-00000105-10074682709309353 [PID: 4032]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"CryptVerifySignatureA@ADVAPI32.DLL\" in \"YoutubeAdvert.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Network Related","name":"Found transport agent related strings used by exchange malware","description":"Found reference to \"This is a multi-part message in MIME format.\" (Indicator: \"This is a multi-part message in MIME format\"; Source: \"00000000-00004032.00000001.69475.05FE0000.00000002.mdmp, 00000000-00004032.00000002.71395.05FE0000.00000002.mdmp, 00000000-00004032.00000003.76907.05FE0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":5,"id":"string-620","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"YoutubeAdvert.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Armory\\\"\n \"YoutubeAdvert.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"YoutubeAdvert.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\WALLETS\"\n \"YoutubeAdvert.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"YoutubeAdvert.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\Documents\\MONERO\\WALLETS\"\n \"YoutubeAdvert.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"YoutubeAdvert.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\WALLETS\"\n \"YoutubeAdvert.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"\n \"YoutubeAdvert.exe\" trying to touch file \"%USERPROFILE%\\Documents\\MONERO\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"YoutubeAdvert.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"YoutubeAdvert.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"648a023e5d0c0f1215028bce","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["RUS"],"submit_name":"YoutubeAdvert.exe","analysis_start_time":"2023-06-14T18:09:03+00:00","indicators_count":{"informative":108,"suspicious":40,"malicious":10},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"6489acc8c3a5d0f9740bbb33","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["RUS"],"submit_name":"YoutubeAdvert.exe","analysis_start_time":"2023-06-14T12:04:25+00:00","indicators_count":{"informative":120,"suspicious":42,"malicious":14},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"95.143.190.57","port":15647,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"}],"processes":[{"pid":4068,"ppid":0,"name":"YoutubeAdvert.exe","command_line":"","sha256":"48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e","normalized_path":"C:\\YoutubeAdvert.exe","uid":"00000000-00004068","icon":"$4e"}],"all_imported_dlls":["wow64win.dll","fltLib.dll","uxtheme.dll","UIAutomationClient.dll","UIAutomationTypes.dll","advapi32.dll","nsi.dll","imm32.dll","wow64.dll","kernel32.dll","wbemsvc.dll","cryptbase.dll","WSHTCPIP.DLL","mscorlib.ni.dll","api-ms-win-core-synch-l1-2-0.dll","System.ni.dll","Microsoft.CSharp.dll","nlssorting.dll","WMINet_Utils.dll","ws2_32.dll","System.Web.Extensions.dll","ntdll.dll","usp10.dll","ole32.dll","System.Security.dll","psapi.dll","System.Drawing.ni.dll","shell32.dll","version.dll","bcrypt.dll","mscoreei.dll","System.Windows.Forms.ni.dll","System.Xml.ni.dll","System.Management.ni.dll","wbemcomn.dll","wbemprox.dll","webengine4.dll","gdi32.dll","sspicli.dll","fastprox.dll","profapi.dll","sechost.dll","System.Dynamic.dll","wow64cpu.dll","vcruntime140_clr0400.dll","api-ms-win-core-xstate-l2-1-0.dll","cryptsp.dll","secur32.dll","ntdsapi.dll","msctf.dll","System.Core.ni.dll","msvcrt.dll","clr.dll","System.Web.dll","aspnet_rc.dll","KernelBase.dll","lpk.dll","System.Configuration.ni.dll","mswsock.dll","wship6.dll","mscoree.dll","rsaenh.dll","RpcRtRemote.dll","wmiutils.dll","rpcrt4.dll","user32.dll","ucrtbase_clr0400.dll","oleaut32.dll","VxSSL32.dll","shlwapi.dll","clrjit.dll","clbcatq.dll","userenv.dll","rpcss.dll","Microsoft.CSharp.ni.dll","System.Dynamic.ni.dll","System.Runtime.Serialization.ni.dll","SMDiagnostics.ni.dll","clrcompression.dll","System.ServiceModel.Internals.dll","System.Security.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"INDEX.BTR","sha256":"b47b58f07d100e62d8152d6fa8fa58a13f4714e31af568f54cfca24e08d1ae99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"name":"MAPPING1.MAP","sha256":"3882098bd6dc1b4247d4d4b1e05645b7bc62b99f9609027c3a02260c895fc139","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"name":"MAPPING2.MAP","sha256":"44a99d6368a410779c8167fdcc555fd818312e20b09559b83959099ef67f6e42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"name":"MAPPING3.MAP","sha256":"d8de1bb9d0eff3476acbb95e1eea7f7d52335a86420544ac0f8c8ce577e75d32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"name":"RecentFileCache.bcf","sha256":"2ea19f772a6f5738ebb9c934b2cbc17eae602a6c1b7080d3708d056dc4085936","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"648a023e5d0c0f1215028bce"},{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6489acc8c3a5d0f9740bbb33"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["648a023e5d0c0f1215028bce","6489acc8c3a5d0f9740bbb33"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 48fe1f7de453… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 48fe1f7de453…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 48fe1f7de453… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 48fe1f7de453…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 48fe1f7de453… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 48fe1f7de453…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]