26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Krider.Generic Sample 6789b863755c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6789b863755c…. Malware family: Ransom.Krider.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac","keywords":["Malicious","Ransom.Krider.Generic","malware analysis","sandbox report","threat intelligence","6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac"],"about":{"@type":"SoftwareApplication","name":"Sample_5a550222ed9ecc0f9ba445d5.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Krider.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")28:T745,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")29:T681,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23c.dat" "" touched file "C:\Windows\System32\l_intl.nls" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" "" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp"2a:Ta59,"" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1)2b:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2c:T4e5,Found malicious artifacts related to "74.125.206.108": ... File SHA256: e335d6057724299136b4f71820da922dc2026034b1fa47eb0a9d43dec9b7d45f (AV positives: 59/68 scanned on 01/11/2018 23:53:08) File SHA256: e7f2060a60bfd02025cd9ff7fb6b7ce75241002f66fcd4f65e526ce2a24492b8 (AV positives: 52/67 scanned on 01/11/2018 23:39:17) File SHA256: e953e3d5e57326e4469cd87b2c5077cc1c2a54c0868010f07ef7c35ab4039ace (AV positives: 48/68 scanned on 01/11/2018 06:56:20) File SHA256: d80a995c5ce224e136e83c25ca8974b5136f040778920a7162b8bb730098f368 (Date: 01/08/2018 15:53:48) File SHA256: 5dcd4253b6a9a4c20c1cbb18f65c645bfe7aa2398840daf8321ebe60d764afb9 (AV positives: 44/66 scanned on 01/02/2018 03:14:14) File SHA256: f8f95d9b705152c1b8a32a4f31e093d76a1be69b6d8e9e114a446721c4874f8c (AV positives: 37/67 scanned on 01/01/2018 17:28:54) File SHA256: 552104351ed121399fe682bd61d89af40aed58df4f19e4fcf9f3e66a9b4e2453 (Date: 01/01/2018 23:39:25) File SHA256: 7d2febe85d23e5f41984433ec23dc8220733ce38c0711c0fa5be746d9826117a (Date: 01/01/2018 11:39:07) File SHA256: d46e32d573598d0e146f40155bbc10cf0bbcafe71f64616ae2a9b12e625f6ab4 (Date: 12/30/2017 20:47:32) File SHA256: 3f949d824743cc54e9962412d10f8ec51ff827aba024a6f749de8d49fd92234a (Date: 12/30/2017 05:27:50)2d:T1083,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "frog.exe") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "frog.exe") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "frog.exe") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "frog.exe") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "frog.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003888-00000BC0-1030088763") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found reference to "System.Security.Cryptography.Rijndael" (Indicator: "Rijndael"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "HMACMD5" (Indicator: "HMAC"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "HMACMD5" (Indicator: "HMACMD5"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMACMD5" (Indicator: "HMAC"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMACMD5" (Indicator: "HMACMD5"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "HMACRIPEMD160" (Indicator: "HMAC"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMACRIPEMD160" (Indicator: "HMAC"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp")2e:T1fe2,"frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000001800000000000000ea5ed8423e3200000800000000000000ffffffffffffffff3400000000000000642f4eeff97f000028ea6f0000000000db041611fa7f000000000000fa7f00002a96d30dfa7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000090ea6f00000000000800000000000000000000000000000000000000000000009a55d8423e320000c3f01411fa7f00000000620efa7f0000a7131511fa7f0000e8ea6f00 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000002000000000000004000000000000000000000000000000000000000000000004000000000000000eb4817e0f97f0000180000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000ffffffffffffffff240000000000000058f86f0000000000040000000000000000000000000000000000000000000000000000000000000085bc19e0f97f00000200000000000000010000000000000001000000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac030ffa7f0000000000000000000051ed1811fa7f00000000000000000000000000000000000085029072176100002a0000000000000050547b02000000008fec1811fa7f0000e0ac030ffa7f0000e0ac030ffa7f0000000000000000000000000000fa7f0000ffffff7f9d7c000000000000000000000000000000000000d8cef70efa7f00002a0000000000000069c3b00efa7f0000310000000000000014020000000000001802000000000000110001100000000070e46f000000000003a39d0efa7f000070e46f000000000000000000000000002b00000000000000000000000000000020b0b60efa7f0000b43fb50efa7f0000e0cef70e (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000070f56f0000000000feffffffffffffff207c7d02000000000100000000000000000000000000000014000000000200000400000073006f00f8f26f000000000032002e0030002e003500300037003200370000007900200043006f006e006600690067005c00000078f56f000000000000f56f00000000000000000100000000020000000000000000000000000000000a020000000000000a02000000000000a88d6be0f97f000000000000000000000000000000000000020000000000000000000000000000003801003900000000feffffffffffffff000000000000000043010000000000003801000000000000781102e0f97f000000000000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000eb4817e0f97f00000000790200000000340000c00000000000000000000000000000790200000000000000000000000030161811fa7f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006bc318e0f97f000070f56f0000000000020000000000000000000000000000000a020000000000000200000002000000feffffffffffffff2100000000000000aa3d1ae0f97f000070f56f000000000020647d020000000004010000000000000a020000000000000000000000000000fe0810e0f97f00000500000000000000010000000000000004010000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c8de0f97f0000000000000000000035e729e0f97f000090fc8ce0f97f00000000000000000000000000000000000000000000000000000000000000000000001e74e0f97f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff0080000000000000000020a87d0200000000304d7e0200000000feffffffffffffffee9f1ce0f97f00000100000000000000c0887e0200000000000000000000000020a87d0200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc8ce0f97f000000000000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000050eb6f000000000000000000000000000000000000000000feffffffffffffff010000000000000000397f0200000000010000800000000000000000000000002b400de0f97f00000100000000000000010000800000000050eb6f00000000003031f40dfa7f000040ea6f00000000002b400de0f97f000040ea6f00000000009c3f0de0f97f0000010000800000000000000000000000008000980200000000000000000000000040ea6f0000000000a2410de0f97f0000b4020000000000000000000000000000010000000000000028e153e0f97f000000000000000000000000000000000000000000000000000070a17e020000000012000080 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000090707f020000000000000000000000000000000000000000feffffffffffffff000000000000000000000000000000000000000000000000204b7e020000000030d56f00000000008800000000000000000000000000000090707f02000000008800000000000000eb4817e0f97f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004e43fee7f97f0000000000000000000000000000000000000000000000000000000000000000000010b97e02000000002c44fee7f97f0000880000000000000090707f020000000010001000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c8de0f97f0000000000000000000035e729e0f97f000090fc8ce0f97f00000000000000000000000000000000000000000000000000000000000000000000001e74e0f97f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff00800000000000000000e0497f0200000000708e800200000000feffffffffffffffee9f1ce0f97f00000100000000000000c07f8002000000000000000000000000e0497f0200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc8ce0f97f000000000000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c8de0f97f0000000000000000000035e729e0f97f000090fc8ce0f97f00000000000000000000000000000000000000000000000000000000000000000000001e74e0f97f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff00800000000000000000804f7f020000000020f27f0200000000feffffffffffffffee9f1ce0f97f00000100000000000000108a8002000000000000000000000000804f7f0200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc8ce0f97f000000000000 (UID: 00000000-00003888) "frog.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c8de0f97f0000000000000000000035e729e0f97f000090fc8ce0f97f00000000000000000000000000000000000000000000000000000000000000000000001e74e0f97f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff00800000000000000000c0507f02000000002015810200000000feffffffffffffffee9f1ce0f97f0000010000000000000070808002000000000000000000000000c0507f0200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc8ce0f97f000000000000 (UID: 00000000-00003888)2f:T742,"frog.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000570069006e005300780053005c0061006d006400360034005f006d006900630072006f0073006f00660074002e0076006300380030002e006300720074005f0031006600630038006200330062003900610031006500310038006500330062005f0038002e0030002e00350030003700320037002e003900330034003800 (UID: 00000000-00003888) "frog.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000ca5ad8423e3200000400000000000000ffffffffffffffff2400000000000000642f4eeff97f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff (UID: 00000000-00003888) "frog.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003888) "frog.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000063007400650064004400610074006100000073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c0063006f006e006600690067005c006d0061006300680069006e0065002e00630005000005fe2f000040a87902 (UID: 00000000-00003888) "frog.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000003808f5e7f97f0000020000000000000000000000000000000000f3e7f97f00003808f5e7f97f0000000000000000000000000000000000008b2001e8f97f000000000000000000000000000000000000000000000000000024c76f000000000000000000 (UID: 00000000-00003888)30:Tbdb,"frog.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")31:T1157,"frog.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\9833e30950e59154b7792b48938e4e97\mscorlib.ni.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\893341977b084a7627561c147da39e0c\System.ni.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuration\966b5aa165d44dd8298c5da3aadff8fc\System.Configuration.ni.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\0b71e28e5738a2fbafb063bf1bbb5a48\System.Xml.ni.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\VERSION.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\mscoree.dll (UID: 00000000-00003888) "frog.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\diasymreader.dll (UID: 00000000-00003888)32:T57e2,"frog.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateWellKnownSidW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter NtGetCurrentProcessorNumber (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateSemaphore (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003888) "frog.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003888)33:Tcab,"REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp34:Tcab,"Read7HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp35:Tcc3,"frog.exe" loaded module "KERNEL32" at base 7ffa10310000 "frog.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffa0df30000 "frog.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffa0df30000 "frog.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffa0df30000 "frog.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffa110e0000 "frog.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa0df30000 "frog.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa0df30000 "frog.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa0df30000 "frog.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9ea0a0000 "frog.exe" loaded module "ADVAPI32.DLL" at base 7ffa0e750000 "frog.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff9fa020000 "frog.exe" loaded module "SHLWAPI.DLL" at base 7ffa0e6f0000 "frog.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffa0d4b0000 "frog.exe" loaded module "VERSION.DLL" at base 7ffa05690000 "frog.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORWKS.DLL" at base 7ff9dfff0000 "frog.exe" loaded module "USER32.DLL" at base 7ffa10d80000 "frog.exe" loaded module "MSCOREE.DLL" at base 7ff9fb2e0000 "frog.exe" loaded module "NTDLL" at base 7ffa11140000 "frog.exe" loaded module "SHELL32.DLL" at base 7ffa0ea50000 "frog.exe" loaded module "KERNEL32.DLL" at base 7ffa10310000 "frog.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\MSCORLIB\9833E30950E59154B7792B48938E4E97\MSCORLIB.NI.DLL" at base 7ff9df110000 "frog.exe" loaded module "OLE32.DLL" at base 7ffa0e800000 "frog.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORJIT.DLL" at base 7ff9e7f30000 "frog.exe" loaded module "RPCRT4.DLL" at base 7ffa10f10000 "frog.exe" loaded module "SSPICLI.DLL" at base 7ffa0d3c0000 "frog.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM\893341977B084A7627561C147DA39E0C\SYSTEM.NI.DLL" at base 7ff9de6d0000 "frog.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.CONFIGURATION\966B5AA165D44DD8298C5DA3AADFF8FC\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9e7d80000 "frog.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_64\SYSTEM.XML\0B71E28E5738A2FBAFB063BF1BBB5A48\SYSTEM.XML.NI.DLL" at base 7ff9de020000 "frog.exe" loaded module "IPHLPAPI.DLL" at base 7ffa0cab0000 "frog.exe" loaded module "WS2_32.DLL" at base 7ffa0ff90000 "frog.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffa0cd20000 "frog.exe" loaded module "BCRYPT.DLL" at base 7ffa0cff0000 "frog.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa0c930000 "frog.exe" loaded module "NTDLL.DLL" at base 7ffa11140000 "frog.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffa05ff0000 "frog.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffa06520000 "frog.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CULTURE.DLL" at base 7ff9fa6b0000 "frog.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 7ff9fb2e0000 "frog.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\DIASYMREADER.DLL" at base 7ff9ddf5000036:T485,"frog.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"37:Taf4,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003888-00000C2A-1029406891] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" [Source: 00000000-00003888-00000C2A-1029571919] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\9833e30950e59154b7792b48938e4e97\mscorlib.ni.dll" [Source: 00000000-00003888-00000C2A-1029909846] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" [Source: 00000000-00003888-00000C2A-1029958121] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll" [Source: 00000000-00003888-00000C2A-1030122539] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System\893341977b084a7627561c147da39e0c\System.ni.dll" [Source: 00000000-00003888-00000C2A-1030256833] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Configuration\966b5aa165d44dd8298c5da3aadff8fc\System.Configuration.ni.dll" [Source: 00000000-00003888-00000C2A-1030296804] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Xml\0b71e28e5738a2fbafb063bf1bbb5a48\System.Xml.ni.dll" [Source: 00000000-00003888-00000C2A-1030340207] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00003888-00000C2A-1030467632] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00003888-00000C2A-1030699335] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003888-00000C2A-1030811210] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\VERSION.dll" [Source: 00000000-00003888-00000C2A-1031322961] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll" [Source: 00000000-00003888-00000C2A-1031963656] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00003888-00000C2A-1031991099] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00003888-00000C2A-1032018466] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll" [Source: 00000000-00003888-00000C2A-1032051061] Observed system executable string:"%WINDIR%\System32\mscoree.dll" [Source: 00000000-00003888-00000C2A-1032078441] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\diasymreader.dll" [Source: 00000000-00003888-00000C2A-1032124185]38:T4bb,"frog.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "frog.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")39:T7e1,"frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3a:T77a,"frog.exe" trying to access non-existent file "C:\FLTLIB.DLL" "frog.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\OLE32.DLL" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" "frog.exe" trying to access non-existent file "C:\SSPICLI.DLL" "frog.exe" trying to access non-existent file "C:\SspiCli.dll" "frog.exe" trying to access non-existent file "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\IPHLPAPI.DLL" "frog.exe" trying to access non-existent file "C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" "frog.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "frog.exe" trying to access non-existent file "C:\iphlpapi.dll" "frog.exe" trying to access non-existent file "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\WS2_32.DLL" "frog.exe" trying to access non-existent file "C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" "frog.exe" trying to access non-existent file "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\BCRYPT.DLL" "frog.exe" trying to access non-existent file "C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\bcrypt.dll" "frog.exe" trying to access non-existent file "C:\BCRYPT.DLL" "frog.exe" trying to access non-existent file "C:\bcrypt.dll" "frog.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "frog.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\VERSION.DLL" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\VERSION.dll"3b:T6a8,"frog.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "frog.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "frog.exe" trying to access non-existent file "C:\FROG.EXE.CONFIG" "frog.exe" trying to access non-existent file "C:\FROG.EXE.LOCAL" "frog.exe" trying to access non-existent file "C:\frog.exe.Local\" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\FUSION.LOCALGAC" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fusion.localgac" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "frog.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH" "frog.exe" trying to access non-existent file "C:\FROG.CONFIG" "frog.exe" trying to access non-existent file "C:\frog.config" "frog.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "frog.exe" trying to access non-existent file "C:\Windows\Globalization\EN-US.NLP" "frog.exe" trying to access non-existent file "C:\WINDOWS\Globalization\en-us.nlp" "frog.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "frog.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"3c:T507,Observed email domain:"smtp.gmail.com" [Source: frog.exe] Observed email domain:"et.mail.smtpexception: the operation has timed out." [Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp] Observed email domain:"at system.net.mail.smtpclient.send(mailmessage message)" [Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp 00000000-00003888.00000000.132423.04D10000.00000004.mdmp] Observed email domain:"ystem.net.mail.smtpexception: the operation has timed out." [Source: 00000000-00003888.00000000.132423.02790000.00000004.mdmp] Observed email domain:"smtp.gmail.com" [Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp] Observed email domain:"byhost:smtp.gmail.com:587" [Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp] Observed email domain:"smtp.gmail.com:587" [Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp] Observed email domain:"system.net.mail.smtpexception" [Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp] Observed email domain:"system.net.mail.smtpexception: the operation has timed out." [Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp] Observed email domain:"system.net.mail.smtpclient" [Source: 00000000-00003888.00000000.132423.04D10000.00000004.mdmp]3d:T85f,Found string "et Framework Data Provider for Oracle" type="System.Data.OracleClient.OracleClientFactory, System.Data.OracleClient, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>" (Indicator: "System.Data.OracleClient"; Source: "00000000-00003888.00000000.132423.02790000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.Odbc" (Indicator: "System.Data.Odbc"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.Odbc.OdbcFactory System.Data Version=2.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" (Indicator: "System.Data.Odbc"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.OleDb" (Indicator: "System.Data.OleDb"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.OleDb.OleDbFactory System.Data Version=2.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" (Indicator: "System.Data.OleDb"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.OracleClient" (Indicator: "System.Data.OracleClient"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.OracleClient.OracleClientFactory System.Data.OracleClient Version=2.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" (Indicator: "System.Data.OracleClient"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Data.SqlClient.SqlClientFactory System.Data Version=2.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp")3e:T6d3,"frog.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003888) "frog.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003888) "frog.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003888) "frog.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI (UID: 00000000-00003888) "frog.exe" called "FindFirstFileW" with parameter C:\frog.INI (UID: 00000000-00003888) "frog.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI (UID: 00000000-00003888) "frog.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI (UID: 00000000-00003888) "frog.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI (UID: 00000000-00003888)3f:T10e2,Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "frog.exe") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "frog.exe") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "frog.exe") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "frog.exe") Found string "CryptoStream" (Indicator: "cryptostream"; File: "frog.exe") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "frog.exe") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "frog.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00003888.00000000.132423.00352000.00000002.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003888.00000000.132423.02790000.00000004.mdmp") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp") Found string "Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" description="Uses RsaCryptoServiceProvider to encrypt and decrypt" keyContainerName="NetFrameworkConfigurationKey" cspProviderName="" useMachineContainer="true" useOAEP="false"/>" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.Rijndael" (Indicator: "rijndael"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.Rijndael" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.HashAlgorithm" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.MD5" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.SHA256" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.SHA384" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.SHA512" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.RIPEMD160" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.RIPEMD160Managed" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp"), Found string "System.Security.Cryptography.HMAC" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003888.00000000.132423.04D10000.00000004.mdmp")40:Tdd8,"frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEHOSTSFILE"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ADDRCONFIGCONTROL"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DISABLESMARTNAMERESOLUTION"; Value: "") "frog.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PREFERLOCALOVERLOWERBINDINGDNS"; Value: "")41:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791111449100,"unified_at":"2026-10-04T10:57:29.100Z","metadata":{"hashes":{"sha256":"6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac","sha1":"7b5eb6ef3b4cb626fbc149fc51f6e6cfad7ca1c1","md5":"9888d798c66482bf3634deee926c6b38","sha512":"a85e13bffa1249fc196aaa1bd74d39ae66de2fe03da7a79e271921fe4034ef69d3b92cd963d75e30ac3f639315bf7c068f90633123f58f947ce9a4bceb970697","ssdeep":"96:a963B2me8kQw1Dxh9ePkY6ZXgd4WhGdZ7t7M2a/xMQA9alNazNt:OlBg2ePkYy8H27t7MxA9kG","ssdeep_chunks":["96:a963B2m","96:963B2me","96:63B2me8","96:3B2me8k","96:B2me8kQ","96:2me8kQw","96:me8kQw1","96:e8kQw1D","96:8kQw1Dx","96:kQw1Dxh","96:Qw1Dxh9","96:w1Dxh9e","96:1Dxh9eP","96:Dxh9ePk","96:xh9ePkY","96:h9ePkY6","96:9ePkY6Z","96:ePkY6ZX","96:PkY6ZXg","96:kY6ZXgd","96:Y6ZXgd4","96:6ZXgd4W","96:ZXgd4Wh","96:Xgd4WhG","96:gd4WhGd","96:d4WhGdZ","96:4WhGdZ7","96:WhGdZ7t","96:hGdZ7t7","96:GdZ7t7M","96:dZ7t7M2","96:Z7t7M2a","96:7t7M2a/","96:t7M2a/x","96:7M2a/xM","96:M2a/xMQ","96:2a/xMQA","96:a/xMQA9","96:/xMQA9a","96:xMQA9al","96:MQA9alN","96:QA9alNa","96:A9alNaz","96:9alNazN","96:alNazNt","192:a963B2m","192:963B2me","192:63B2me8","192:3B2me8k","192:B2me8kQ","192:2me8kQw","192:me8kQw1","192:e8kQw1D","192:8kQw1Dx","192:kQw1Dxh","192:Qw1Dxh9","192:w1Dxh9e","192:1Dxh9eP","192:Dxh9ePk","192:xh9ePkY","192:h9ePkY6","192:9ePkY6Z","192:ePkY6ZX","192:PkY6ZXg","192:kY6ZXgd","192:Y6ZXgd4","192:6ZXgd4W","192:ZXgd4Wh","192:Xgd4WhG","192:gd4WhGd","192:d4WhGdZ","192:4WhGdZ7","192:WhGdZ7t","192:hGdZ7t7","192:GdZ7t7M","192:dZ7t7M2","192:Z7t7M2a","192:7t7M2a/","192:t7M2a/x","192:7M2a/xM","192:M2a/xMQ","192:2a/xMQA","192:a/xMQA9","192:/xMQA9a","192:xMQA9al","192:MQA9alN","192:QA9alNa","192:A9alNaz","192:9alNazN","192:alNazNt","96:OlBg2eP","96:lBg2ePk","96:Bg2ePkY","96:g2ePkYy","96:2ePkYy8","96:ePkYy8H","96:PkYy8H2","96:kYy8H27","96:Yy8H27t","96:y8H27t7","96:8H27t7M","96:H27t7Mx","96:27t7MxA","96:7t7MxA9","96:t7MxA9k","96:7MxA9kG"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Sample_5a550222ed9ecc0f9ba445d5.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":9216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1515784648000,"last_seen":1775721274000,"last_multi_scan":1775721274000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":106,"suspicious_count":21,"malicious_count":7,"total":134},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/MSIL.Gorf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Redcap.hljpu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Krider.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_MSIL_Gorf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Krider.3 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.LP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.Gorf.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Malicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Generic trojan.lb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRansom.LIVM-4782","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.988274","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Krider.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"malicious","value":"Sends network traffic on a typical mail related ports"},{"type":"suspicious","value":"Contacts Mail Related Domain Names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"},{"type":"informative","value":"Contains ability to perform email related activity (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"dw20.exe\" was created by \"6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"smtp.gmail.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"74.125.206.108:587\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"d:\\project_mini\\mwave\\frog\\frog\\obj\\Release\\frog.pdb\"\n \".pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Cab6724.tmp\"\n \"\" created file \"%TEMP%\\Tar6725.tmp\"\n \"\" created file \"%TEMP%\\Cab7B37.tmp\"\n \"\" created file \"%TEMP%\\Tar7B38.tmp\"\n \"\" created file \"%TEMP%\\Cab910D.tmp\"\n \"\" created file \"%TEMP%\\Tar910E.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\39eb5280-f818-11e7-989d-0a00278a626a\"\n \"Global\\39eb5280-f818-11e7-989d-0a00278a626a\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 69A80000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"dw20.exe\" with commandline \"-x -s 1248\" (UID: 00016847-00003704)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab7B37.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"Cab6724.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"Cab910D.tmp\" has type \"Microsoft Cabinet archive data 54487 bytes 1 file\"\n \"Tar6725.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Tar910E.tmp\" has type \"data\"\n \"Tar7B38.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"Microsoft Cabinet archive data 54487 bytes 1 file\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"smtp.gmail.com\"\n Heuristic match: \"ruamylove.28@gmail.com\"\n Pattern match: \"http://pki.goog/gsr2/GTSGIAG3.crt0\"\n Pattern match: \"http://ocsp.pki.goog/GTSGIAG30\"\n Pattern match: \"http://crl.pki.goog/GTSGIAG3.crl0\"\n Pattern match: \"http://ocsp.pki.goog/gsr202\"\n Pattern match: \"http://crl.pki.goog/gsr2/gsr2.crl0\"\n Pattern match: \"https://pki.goog/repository/0\"\n Pattern match: \"www.download.windowsupdate.com\"\n Heuristic match: \".mobi\"\n Heuristic match: \"gmail.com\"\n Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00015424-00001036-00000105-43260037","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"dw20.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"dw20.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://gmail.com\" as malicious (1% detection rate)\n 1/66 reputation engines marked \"http://smtp.gmail.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\", Handle: 1320)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$2a","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"250-smtp.gmail.com at your service, [193.70.47.200]250-SIZE 35882577250-8BITMIME250-STARTTLS250-ENHANCEDSTATUSCODES250-PIPELINING250-CHUNKING250 SMTPUTF8@\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe\" marked \"%TEMP%\\Cab6724.tmp\" for deletion\n \"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe\" marked \"%TEMP%\\Tar6725.tmp\" for deletion\n \"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe\" marked \"%TEMP%\\Cab7B37.tmp\" for deletion\n \"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe\" marked \"%TEMP%\\Tar7B38.tmp\" for deletion\n \"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe\" marked \"%TEMP%\\Cab910D.tmp\" for deletion\n \"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe\" marked \"%TEMP%\\Tar910E.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\Cab6724.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar6725.tmp\" with delete access\n \"\" opened \"%TEMP%\\Cab7B37.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar7B38.tmp\" with delete access\n \"\" opened \"%TEMP%\\Cab910D.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar910E.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2b","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"smtp.gmail.com\" is probably a mail server","origin":"Network Traffic","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"Cab7B37.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"Cab6724.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"Cab910D.tmp\" has type \"Microsoft Cabinet archive data 54487 bytes 1 file\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"Microsoft Cabinet archive data 54487 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/63 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/63 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 1320)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 1320)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe\" (Handle: 1320)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"\"Mail traffic to 74.125.206.108 on port 587 (SMTP)","origin":"Network Traffic","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"dw20.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 04D10000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"frog.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\WINSOCK\")\n \"frog.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP6\\PARAMETERS\\WINSOCK\")\n \"frog.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP6\\PARAMETERS\\WINSOCK\")\n \"frog.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK\\SETUP MIGRATION\\PROVIDERS\")\n \"frog.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK\\SETUP MIGRATION\\PROVIDERS\\TCPIP6\")\n \"frog.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK\\SETUP MIGRATION\\PROVIDERS\\TCPIP6\")\n \"frog.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\.NET CLR NETWORKING\\PERFORMANCE\")\n \"frog.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\.NET CLR NETWORKING\\PERFORMANCE\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1028876073 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1028884883 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1029128271 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1029136513 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1029788729 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1029797969 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1030525406 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1030534730 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1030871038 [PID: 3888]\n \"frog.exe\" queried SystemProcessInformation at 00000000-00003888-00000C15-1030880195 [PID: 3888]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"dw20.exe\" [UID: 00000000-00002948]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"EncryptFile\" (Indicator: \"EncryptFile\"; File: \"frog.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"frog.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"frog.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"frog.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, Version=\" (Indicator: \"encryptedkey\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, Version=2.0.0.0\" (Indicator: \"encryptedkey\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform symmetric crypto operations\n Matched sigs: Contains ability to perform crypto operations\n Matched sigs: Contains ability to perform symmetric encryption (Dotnet)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003888-00000C2B-1031023080\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"frog.exe\"\n Observed dotnet function \"GetDirectories\" in \"frog.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetDrives\" (Source: \"00000000-00003888.00000000.132423.00352000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00003888.00000000.132423.00352000.00000002.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00003888.00000000.132423.00352000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003888-00000C2B-1031023080\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003888-00000C2B-1029691785\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003888-00000C2B-1029692273\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003888-00000C2B-1031319538\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003888-00000C2B-1031069621\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"frog.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"frog.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"frog.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"frog.exe\" called \"IsWow64Process\" with parameter \"3888\" - (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"frog.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"frog.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00003888)\n \"frog.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"frog.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00003888)\n \"frog.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"frog.exe\"\n Observed function \"get_MachineName\" in \"frog.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"frog.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"frog.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"01,4436,3024,,RtlGetVersion,NTDLL.dll,\"00:34:25.031\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003888.00000000.132423.02790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"frog.exe\" called \"CreateProcessW\" with parameter \"dw20.exe -x -s 1180\" - (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"EncryptFile\"; File: \"frog.exe\")\n Found reference to API (Indicator: \"EncryptFile\"; Source: \"00000000-00003888.00000000.132423.00352000.00000002.mdmp, 00000000-00003888.00000000.132423.048B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"frog.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\ole32.dll\" - [base:0; Status:c0000135]\n \"frog.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\iphlpapi.dll\" - [base:0; Status:c0000135]\n \"frog.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\ws2_32.dll\" - [base:0; Status:c0000135]\n \"frog.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]\n \"frog.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\VERSION.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"frog.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"ruamylove.28@gmail.com\"\n Pattern match: \"uamylove.28@gmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"frog.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0E590000\n \"frog.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 0CFF0000\n \"dw20.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0E590000\n \"dw20.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 0CFF0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"frog.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 10F10000\n \"dw20.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 10F10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"frog.exe\" was detected as \".NET\" and name: \"Library\"\n \"frog.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"frog.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"frog.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"frog.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"frog.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$36","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\dw20.exe\" [Source: 00000000-00003888-00000BC0-1031385170]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\\\dw20.exe\" [Source: 00000000-00003888-00000C46-6696726416]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"dw20.exe\" (UID: 00000000-00002948) was launched with new environment variables: \"USERDNSDOMAIN=\"dTErkJ2NiUppS0s\"\"\n Process \"dw20.exe\" (UID: 00000000-00002948) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"smtp.gmail.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"frog.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"frog.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"dw20.exe\" with commandline \"-x -s 1180\" (UID: 00000000-00002948)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"frog.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"frog.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"frog.exe\" queries basic process information of the \"C:\\frog.exe\" (UID: 3888)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"frog.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"frog.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"frog.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"frog.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"frog.exe\" trying to touch file \"C:\\frog.exe\"\n \"frog.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"frog.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"frog.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"frog.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"frog.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"frog.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003888-00000C2B-1030772247\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003888-00000C2B-1030759608\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform email related activity (Dotnet)","description":"Observed Namespace \"System.Net.Mail.MailMessage\" and MemberReference \".ctor\" in \"frog.exe\"\n Observed Namespace \"System.Net.Mail.SmtpClient\" and MemberReference \".ctor\" in \"frog.exe\"\n Observed Namespace \"System.Net.Mail.SmtpClient\" and MemberReference \"set_Host\" in \"frog.exe\"\n Observed Namespace \"System.Net.Mail.SmtpClient\" and MemberReference \"set_Port\" in \"frog.exe\"\n Observed Namespace \"System.Net.Mail.SmtpClient\" and MemberReference \"set_Credentials\" in \"frog.exe\"\n Observed Namespace \"System.Net.Mail.SmtpClient\" and MemberReference \"set_EnableSsl\" in \"frog.exe\"\n Observed Namespace \"System.Net.Mail.SmtpClient\" and MemberReference \"Send\" in \"frog.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.003","relevance":1,"id":"static-160","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Mail\" in \"frog.exe\"\n Observed namespace \"System.Net\" in \"frog.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"SmtpClient\" (Indicator: \"smtp\"; File: \"frog.exe\")\n Found string \"smtp.gmail.com\" (Indicator: \"smtp\"; File: \"frog.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003888-00000C2B-1030759608\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; Source: \"00000000-00003888-00000C2B-1030805784\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately.\" (Indicator: \" socket \"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found reference to API \"A non-blocking socket operation could not be completed immediately\" (Indicator: \" socket \"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"ruamylove.28@gmail.com\" (Indicator: \"@gmail.\"; File: \"frog.exe\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003888\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"01,4436,3024,,RtlGetVersion,NTDLL.dll,\"00:34:25.031\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003888.00000000.132423.02790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"frog.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"frog.exe\" called \"GetComputerNameW\" (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"frog.exe\" called \"GetUserNameW\" (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"applicationName=\"/\" requiresUniqueEmail=\"false\" passwordFormat=\"Hashed\" maxInvalidPasswordAttempts=\"5\" minRequiredPasswordLength=\"7\" minRequiredNonalphanumericCharacters=\"1\" passwordAttemptWindow=\"10\" passwordStrengthRegularExpression=\"\"/>\" (Indicator: \"password\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00003888.00000000.132423.04D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003888.00000000.132423.02790000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003888.00000000.132423.02790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003888-00000C2B-1031274561","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"frog.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\dw20.exe\" launched with commandline \"-x -s 1180\" (UID: 00000000-00002948)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"frog.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"2000810200000000\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"frog.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"smtp.gmail.com\"\n \"pHints\": \"6fe310\"\n \"ppResult\": \"c\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\frog.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\frog.exe\" connects to 172.253.115.108 on port 587 (TCP); Domain: \"smtp.gmail.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"frog.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":52,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69d75b39f571d76a6208ad8b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.Gorf","contacted_countries":["USA"],"submit_name":"frog.exe","analysis_start_time":"2026-04-09T07:54:34+00:00","indicators_count":{"informative":103,"suspicious":12,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"5a5908b07ca3e12b502d7d73","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Krider","contacted_countries":["USA"],"submit_name":"Sample_5a550222ed9ecc0f9ba445d5.bin","analysis_start_time":"2018-01-12T20:12:23+00:00","indicators_count":{"informative":15,"suspicious":15,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"74.125.206.108","port":587,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"address":"172.253.115.108","port":587,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}],"dns_resolutions":[{"domain":"smtp.gmail.com","address":"74.125.206.109","country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"1995-08-13T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}],"processes":[{"pid":1036,"ppid":0,"name":"6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe","command_line":"","sha256":"6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac","normalized_path":"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe","uid":"00015424-00001036","icon":"$41"},{"pid":3704,"ppid":1036,"name":"dw20.exe","command_line":"-x -s 1248","sha256":"728f9cfd55a2d64816805bce935e28034755374e0163a3415f33ad807fbc91cc","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe","parent_uid":"00015424-00001036","uid":"00016847-00003704"}],"all_imported_dlls":["IPHLPAPI.DLL","wship6.dll","oleaut32.dll","secur32.dll","msvcr80.dll","ole32.dll","dhcpcsvc.dll","FWPUCLNT.DLL","credssp.dll","msasn1.dll","diasymreader.dll","lpk.dll","cryptbase.dll","security.dll","gpapi.dll","devrtl.dll","gdi32.dll","cryptsp.dll","mscoree.dll","System.Xml.ni.dll","rasadhlp.dll","ncrypt.dll","setupapi.dll","KernelBase.dll","mscorwks.dll","wer.dll","System.ni.dll","tzres.dll","rsaenh.dll","schannel.dll","advapi32.dll","msctf.dll","profapi.dll","mscorlib.ni.dll","dnsapi.dll","ws2_32.dll","bcrypt.dll","apphelp.dll","msvcrt.dll","WSHTCPIP.DLL","bcryptprimitives.dll","mscorrc.dll","mscoreei.dll","shlwapi.dll","dhcpcsvc6.dll","SensApi.dll","Culture.dll","ntdll.dll","shell32.dll","cryptnet.dll","cabinet.dll","cfgmgr32.dll","devobj.dll","imm32.dll","nsi.dll","crypt32.dll","webio.dll","version.dll","psapi.dll","sechost.dll","System.Configuration.ni.dll","mswsock.dll","rpcrt4.dll","mscorjit.dll","sspicli.dll","Wldap32.dll","winhttp.dll","userenv.dll","kernel32.dll","user32.dll","usp10.dll","winnsi.dll","kernel.appcore.dll","windows.storage.dll","fltLib.dll","aepic.dll","dbgcore.dll","sfc_os.dll","gdi32full.dll","dbghelp.dll","combase.dll","VxSSL64.dll","ucrtbase.dll","msvcp_win.dll","ntmarta.dll","powrprof.dll","sfc.dll","mscordacwks.dll","comctl32.dll","SHCore.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Cab6724.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"190682520e5be196fd70b7bf91eaf319cc125db98105c9da7a1b0cbcfda61313","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Cab7B37.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Cab910D.tmp","sha256":"190682520e5be196fd70b7bf91eaf319cc125db98105c9da7a1b0cbcfda61313","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Tar6725.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Tar7B38.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Tar910E.tmp","sha256":"216100a4580b1b1601bc8320008e6e299fd70008cfeaf0fe3ab82055255de6b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe.config","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\dw20.exe","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System32\\en-US\\wer.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\symbols\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"C:\\6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac.exe","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"C:\\frog.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\symbols\\exe\\frog.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\exe\\frog.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"%WINDIR%\\frog.pdb","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"},{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\39eb5280-f818-11e7-989d-0a00278a626a","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"Global\\39eb5280-f818-11e7-989d-0a00278a626a","sources":[{"report_type":"sandbox","report_id":"5a5908b07ca3e12b502d7d73"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3888:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"\\BaseNamedObjects\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"SM0:3888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"Local\\SM0:3888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]},{"name":"SM0:3888:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69d75b39f571d76a6208ad8b"}]}]}},"report_ids":{"sandbox_job_ids":["69d75b39f571d76a6208ad8b","5a5908b07ca3e12b502d7d73"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Krider.Generic Sample 6789b863755c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6789b863755c…. Malware family: Ransom.Krider.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Krider.Generic Sample 6789b863755c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6789b863755c…. Malware family: Ransom.Krider.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6789b863755c6c53eda4b3f8e12e619a3d768e35b46845c238dd7c89cf8a80ac"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Krider.Generic Sample 6789b863755c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6789b863755c…. Malware family: Ransom.Krider.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]