24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6e05eacb5ba8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6e05eacb5ba8…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9ce,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000070f33588a383b47110022f01687d7d74b8f12f0140b1b471d47dacf8feffffffd4f02f010272b37178f02f010000a87770f12f011b72b371e0dfc97408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000000f12f01000000000800000000000000000000000000000000000000000000000000000048f335880000000040f12f016992b974ffffffff3400000000f12f0108000000000000000000a87770f12f012794b97408f12f010b0000000000000058f12f01 (UID: 00000000-00006532) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006532) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006532) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02cf5749cf02f01226e9a740000b703000000002d6e9a743f837c9e2d000000ecb7eb7420f12f01b1ce98009885520320ac5103150000008000000060f02f010000f500e4f02f0170c89b745b02f3ebfeffffff2d000000d0ccfa7427000000b4f02f01856a9c741c23a174f4f02f01f85f9c7408000000bb699b74b2699b7457837c9e2d000000ecb7eb7427000000d0ccfa74c8f02f012d000000d0ccfa7427000000f8f02f01856a9c741c23a17440f12f017e8af974ee8cf974738af974e350db402d000000ecb7eb7427000000d0ccfa74fc9ab703909ab703e350db4008f12f01fc523775f4f12f01e084f9749b50c134feffffff738af974 (UID: 00000000-00006532)26:T4ec,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006532) "file.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006532)27:T132f,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006532) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00006532)28:T524,"file.exe" loaded module "KERNEL32" at base 76fb0000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74a90000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74a90000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74a90000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74930000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74a90000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74a90000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74a90000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73170000 "file.exe" loaded module "USER32.DLL" at base 76e30000 "file.exe" loaded module "ADVAPI32.DLL" at base 74d90000 "file.exe" loaded module "NTDLL.DLL" at base 77ad0000 "file.exe" loaded module "WINMM.DLL" at base 730a0000 "file.exe" loaded module "NTDLL" at base 77ad0000 "file.exe" loaded module "KERNEL32.DLL" at base 76fb0000 "file.exe" loaded module "SHELL32.DLL" at base 74e90000 "file.exe" loaded module "GDI32.DLL" at base 77a80000 "file.exe" loaded module "OLE32.DLL" at base 77710000 "file.exe" loaded module "OLEAUT32.DLL" at base 77610000 "file.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76fb000029:T7e1,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2a:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006532.00000000.178682.03510000.00000004.mdmp")2b:T3cf6,Assembly shows XOR instruction xor al byte ptr [edx] in Stream UID: 00000000-00005772-51875-151-0036DF10 Assembly shows XOR instruction xor al DAh in Stream UID: 00000000-00005772-51875-151-0036DF10 Assembly shows XOR instruction xor edx 2Fh in Stream UID: 00000000-00005772-51875-199-0036B8A0 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00005772-51875-201-0036A2C0 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005772-51875-201-0036A2C0 Assembly shows XOR instruction xor eax dword ptr [esi+08h] in Stream UID: 00000000-00005772-51875-317-0035EC70 Assembly shows XOR instruction xor ecx dword ptr [0037896Ch] in Stream UID: 00000000-00005772-51875-323-0035E960 Assembly shows XOR instruction xor ebx 62h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor byte ptr [ebp+esi+35C21100h] bh in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35C21100h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35BC4000h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35C2B200h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35BCA000h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35C1F200h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35BCC900h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35C25000h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35C23400h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35C0E000h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor eax 35C1A300h in Stream UID: 00000000-00005772-51875-418-0035BBA0 Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00005772-51875-460-0035AB80 Assembly shows XOR instruction xor edi 000000B6h in Stream UID: 00000000-00005772-51875-460-0035AB80 Assembly shows XOR instruction xor eax 35AE3800h in Stream UID: 00000000-00005772-51875-460-0035AB80 Assembly shows XOR instruction xor edx 000000FFh in Stream UID: 00000000-00005772-51875-461-0035AAF0 Assembly shows XOR instruction xor esi 01h in Stream UID: 00000000-00005772-51875-461-0035AAF0 Assembly shows XOR instruction xor esi dword ptr [ebp-2Ch] in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax dword ptr [ebp-1Ch] in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 08h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor esi 12477CDFh in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor edx 12477CDFh in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor edx esi in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A3C400h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A09E00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 3599AC00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 359A9200h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A96D00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A98300h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35AA3B00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A24000h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A2DE00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A26C00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35978F00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A1E400h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 3593AF00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 3596B600h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 3596A000h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 3596B000h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35979B00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A2CD00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A2D300h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A3A100h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35AA2400h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35AA6100h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 359FE400h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35A08200h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 00000100h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor eax 35AC1A00h in Stream UID: 00000000-00005772-51875-474-00359EF0 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00005772-51875-477-00359B60 Assembly shows XOR instruction xor edi 438510AEh in Stream UID: 00000000-00005772-51875-477-00359B60 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005772-51875-477-00359B60 Assembly shows XOR instruction xor edx 211CD423h in Stream UID: 00000000-00005772-51875-552-00355FA0 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00005772-51875-552-00355FA0 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005772-51875-552-00355FA0 Assembly shows XOR instruction xor eax 3560C000h in Stream UID: 00000000-00005772-51875-552-00355FA0 Assembly shows XOR instruction xor eax 35618300h in Stream UID: 00000000-00005772-51875-552-00355FA0 Assembly shows XOR instruction xor eax 3562A900h in Stream UID: 00000000-00005772-51875-552-00355FA0 Assembly shows XOR instruction xor bl byte ptr [esp+ecx-000000ABh] in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor bl 30h in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor eax 09h in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor eax 35591000h in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor eax 355D3600h in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor eax 355A1000h in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor eax 355D5800h in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor eax 355BB800h in Stream UID: 00000000-00005772-51875-563-00355880 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00005772-51875-564-003557E0 Assembly shows XOR instruction xor edx 4EBD500Bh in Stream UID: 00000000-00005772-51875-564-003557E0 Assembly shows XOR instruction xor dl byte ptr [esp+ecx+04h] in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor edi BE641466h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor ebx 02h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor edi FFEB3C46h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor al E2h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax FFEB3C46h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 3518A200h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 3518AB00h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 35194500h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 35195000h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 35195200h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 3528EB00h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 35239E00h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 352A4700h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 35274C00h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 35250300h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 351FE600h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 35309C00h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 3526B100h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor eax 3538CD00h in Stream UID: 00000000-00005772-51875-630-003517E0 Assembly shows XOR instruction xor cl byte ptr [esp+eax+00000290h] in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ebx 00000099h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor bl byte ptr [esp+edx+00000290h] in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ebx A0B993EBh in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ecx 00000099h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor cl byte ptr [esp+ebx+00000290h] in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edi 4Ch in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edi FFFFFFFEh in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ecx 02h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ebx esi in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ebx 18h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edx F38814F3h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor esi 01h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edi 01h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edi 02h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ecx 7Ah in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor al byte ptr [esp+edx+2Ch] in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor dl byte ptr [esp+ecx+2Ch] in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor esi 59h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor bl byte ptr [esi-61C4FFCCh] in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor eax 550034D5h in Stream UID: 00000000-00005772-51875-790-0034B150 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005772-51875-939-0033C3C0 Assembly shows XOR instruction xor ecx dword ptr [00375D6Ch] in Stream UID: 00000000-00005772-51875-941-0033C220 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005772-51875-950-0033B6C0 Assembly shows XOR instruction xor eax 000000F4h in Stream UID: 00000000-00005772-51875-950-0033B6C0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005772-51875-950-0033B6C0 Assembly shows XOR instruction xor cl 35h in Stream UID: 00000000-00005772-51875-950-0033B6C0 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00005772-51875-950-0033B6C0 Assembly shows XOR instruction xor dword ptr [edx+73h] ebx in Stream UID: 00000000-00005772-51875-950-0033B6C0 Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00005772-51875-952-0033B2A0 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00005772-51875-952-0033B2A0 Assembly shows XOR instruction xor edx dword ptr [00375D8Ch] in Stream UID: 00000000-00005772-51875-1172-0033C513 Assembly shows XOR instruction xor ecx dword ptr [00375F64h] in Stream UID: 00000000-00005772-51875-1188-0033CD47 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00005772-51875-1586-00359CB0 Assembly shows XOR instruction xor edi 438510AEh in Stream UID: 00000000-00005772-51875-1586-00359CB0 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005772-51875-1586-00359CB0 Assembly shows XOR instruction xor ecx 0993E0AFh in Stream UID: 00000000-00005772-51875-1643-00360B03 Assembly shows XOR instruction xor ecx 7021DDCBh in Stream UID: 00000000-00005772-51875-1643-00360B03 Assembly shows XOR instruction xor edx ebp in Stream UID: 00000000-00005772-51875-2138-0033C2EB Assembly shows XOR instruction xor eax dword ptr [00375DA4h] in Stream UID: 00000000-00005772-51875-2172-0033C4D72c:T3056,Found XOR loop in file "sample.bin" at offset 44228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 179507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 191151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 223383; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 722649; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 872679; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 997565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1014518; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1027043; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1067880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1105317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1117377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1120069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1232200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1263099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1293860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1334673; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1355198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1359068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1462940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1465742; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1478024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1479645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1491128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1504054; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1541352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1555435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1559061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1575824; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1587339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1612069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1621698; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1649867; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1652626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1661249; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1685853; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1687355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1723567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1820459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1872722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 12024; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 42413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 61201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 63707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 104576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 143091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 209969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 241445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 282218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 287004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 335749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 371910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 461247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 507925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 600928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 764677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 852165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 868753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 870154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 872818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 933211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1001938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1117697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1322735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1415077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1427292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1436520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1479319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1534759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1623578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1677908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1715758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1799651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 167065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 170332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 171475; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 172379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 178717; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 191736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 194317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 217792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 316227; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 318380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 340112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 407164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 492599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 742767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 784554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 928816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 941166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 995860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1001185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1003667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1032179; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1039141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1040024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1059398; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1062587; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1066678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1076217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1084310; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1095912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1133665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1135388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1136102; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1156529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1160361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1177087; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1194862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1239692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1240039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1264605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1278950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1280555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1283451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1285953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1289843; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1302968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1314373; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1335878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1339099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1352068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1361859; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1364269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1385131; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1393900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1420301; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1431534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1444295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1453457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1464738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1467196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1474896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1496289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1512513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1514252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1525621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1533032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1538563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1574889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1594540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1601612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1606109; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1611833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1618646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1657935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1694032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1695396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1697308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1727415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1730937; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1757277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1762631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1804429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1805997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1810254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1815255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1817856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1827790; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1837861; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1857118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1870322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1877029; code bytes = 80302d:T56e,"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "OLLYDBG" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "GBDYLLO" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "pediy06" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "FilemonClass" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "PROCMON_WINDOW_CLASS" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "RegmonClass" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "18467-41" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "Regmonclass" "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" searching for class "Filemonclass"2e:T916,"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8d4b28" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8dcab0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8d6e98" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8d1d10" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8dcbf8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8d0988" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8d0988" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"}2f:T748,Found URL "https://property-imper.sbs/apiproperty-imper.sbsroperty-imper.sbsetdrivetypeetdrivetype?\c:\windows\s'0000e000000000000000property-imper.sbs0389b0a35" - Source: "00000000-00005772.00000000.80059.00850000.00000004.mdmp") Found URL "https://property-imper.sbs/apiqjmdqj" - Source: "00000000-00005772.00000000.80059.00850000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199724331900steamcommunity.comsteamcommunity.comory-tense-faz.sbs/apia2efcee03d6.exeoat.sbs/apia2efcee03d6.exea2efcee03d6.exeproperty-imper.sbsware\microsoft\windows\currentversion\internet" - Source: "00000000-00005772.00000001.80225.00850000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199724331900yqmg;udefault;u2.5.4.3;u2.5.4.4;u2.5.4.5;u2.5.4.6;u2.5.4.7;u2.5.4.8;u2.5.4.9n!\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006532.00000000.178682.03510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.946962103342448","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006532-00000C29-1791819488\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006532)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"file.exe\" called \"IsWow64Process\" with parameter \"6532\" - (UID: 00000000-00006532)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"file.exe\" called \"GetWindowTextA\" (UID: 00000000-00006532)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006532)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"file.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006532)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"file.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$26","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"ss Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00006532.00000000.178682.03510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"stry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Pacific Standard Time\\Dynamic DST\" in Source: 00000000-00006532.00000000.178682.03510000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:6532:168:WilStaging_02\"\n \"Local\\SM0:6532:168:WilStaging_02\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 745A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 772D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \"\"\n \"file\" has an executable section named \"bydimkjm\"\n \"file\" has an executable section named \"rvusllyz\"\n \"file\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \"\"\n \"file\" has an writable section named \".rsrc\"\n \"file\" has an writable section named \".idata\"\n \"file\" has an writable section named \"bydimkjm\"\n \"file\" has an writable section named \"rvusllyz\"\n \"file\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"file\" file has an entrypoint instructions - \"jmp\t0x8ad00a,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"bydimkjm\" is \"0x1a3e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x2af000\" greater than 0x100000\n Virtual size of \"bydimkjm\" is \"0x1a4000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 6532 -ip 6532\" (UID: 00000000-00005012)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6532 -s 760\" (UID: 00000000-00005008)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6532 -s 760\" (UID: 00000000-00007744)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 6532 -ip 6532\" (UID: 00000000-00005012)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6532 -s 760\" (UID: 00000000-00005008)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 6532 -s 760\" (UID: 00000000-00007744)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 321726)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 6532)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ym.dj\"\n Heuristic match: \"o#6.es\"\n Heuristic match: \"zw.gy\"\n Heuristic match: \"_r.su\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006532.00000000.178682.03510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1790806630 [PID: 6532]\n \"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1790817417 [PID: 6532]\n \"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1791071367 [PID: 6532]\n \"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1791080574 [PID: 6532]\n \"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1791837986 [PID: 6532]\n \"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1791847656 [PID: 6532]\n \"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1791930096 [PID: 6532]\n \"file.exe\" queried SystemProcessInformation at 00000000-00006532-00000C13-1791940654 [PID: 6532]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file\" has section name with entropy \"7.97766609961\"\n \"file\" has section name .rsrc with entropy \"6.01408938234\"\n \"file\" has section name bydimkjm with entropy \"7.95351090655\"\n \"file\" has section name rvusllyz with entropy \"6.21271638009\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"file.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00006532)\n \"file.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00006532)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"file\" claimed CRC 1937316 while the actual is CRC 1898086","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"file\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00005772.00000000.80059.00850000.00000004.mdmp, 00000000-00005772.00000001.80225.00850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005772.00000000.80059.00850000.00000004.mdmp, 00000000-00005772.00000001.80225.00850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005772-00000C2C-256024258\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005772-00000C2C-258727682\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005772)\n \"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00005772)\n \"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005772.00000000.80059.00850000.00000004.mdmp, 00000000-00005772.00000001.80225.00850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020735d6a@ADVAPI32.dll\"\n \"0e000f00e4735d6a@ADVAPI32.dll\"\n \"0e000f0050745d6a@ADVAPI32.dll\"\n \"11001200d47d5d6a@ADVAPI32.dll\"\n \"110012007c7e5d6a@ADVAPI32.dll\"\n \"12001300cc7e5d6a@ADVAPI32.dll\"\n \"12001300387f5d6a@ADVAPI32.dll\"\n \"14001500e4b75d6a@ADVAPI32.dll\"\n \"1400150000b85d6a@ADVAPI32.dll\"\n \"140015001cb85d6a@ADVAPI32.dll\"\n \"1700180038b85d6a@ADVAPI32.dll\"\n \"0d000e0054b85d6a@ADVAPI32.dll\"\n \"1100120064b85d6a@ADVAPI32.dll\"\n \"110012007cb85d6a@ADVAPI32.dll\"\n \"0f001000ecb95d6a@ADVAPI32.dll\"\n \"1400150038ba5d6a@ADVAPI32.dll\"\n \"1400150054ba5d6a@ADVAPI32.dll\"\n \"0c000d00a8ba5d6a@ADVAPI32.dll\"\n \"0c000d00b8ba5d6a@ADVAPI32.dll\"\n \"0e000f00c8ba5d6a@ADVAPI32.dll\"\n \"0e000f00dcba5d6a@ADVAPI32.dll\"\n \"0b000c00f0ba5d6a@ADVAPI32.dll\"\n \"180019008cbd5d6a@RPCRT4.dll\"\n \"13001400bcbd5d6a@RPCRT4.dll\"\n \"14001500d4bd5d6a@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"blade-govern.sbs\"\n \"disobey-curly.sbs\"\n \"leg-sate-boat.sbs\"\n \"motion-treesz.sbs\"\n \"occupy-blushi.sbs\"\n \"powerful-avoids.sbs\"\n \"story-tense-faz.sbs\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$2d","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 321726)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$2e","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005772-00000C2C-259745565\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005772-00000C2C-259746140\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005772.00000000.80059.00E00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"blade-govern.sbs\" has high entropy\n Contacted domain: \"disobey-curly.sbs\" has high entropy\n Contacted domain: \"powerful-avoids.sbs\" has high entropy\n Contacted domain: \"story-tense-faz.sbs\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005772.00000000.80059.00850000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005772.00000000.80059.00850000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005772.00000000.80059.00850000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005772.00000000.80059.00850000.00000004.mdmp\")\n Found string \"\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005772.00000001.80225.00850000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005772.00000001.80225.00850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SHEmptyRecycleBinW\" (Source: 6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6, API is part of module: SHELL32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6\" has section name with entropy \"7.9776660996071636\"\n \"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6\" has section name bydimkjm with entropy \"7.95351090655131\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe\" is setting \"ThreadHideFromDebugger\" data for thread ID 0xfffffffe","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6.exe queries ProcessDebugPort (UID: 5772)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]}],"intel_graph":{"map":{"Domain:blade-govern.sbs":{"type":"Domain","value":"blade-govern.sbs"},"Domain:disobey-curly.sbs":{"type":"Domain","value":"disobey-curly.sbs"},"Domain:leg-sate-boat.sbs":{"type":"Domain","value":"leg-sate-boat.sbs"},"Domain:motion-treesz.sbs":{"type":"Domain","value":"motion-treesz.sbs"},"Domain:occupy-blushi.sbs":{"type":"Domain","value":"occupy-blushi.sbs"},"Domain:powerful-avoids.sbs":{"type":"Domain","value":"powerful-avoids.sbs"},"Domain:story-tense-faz.sbs":{"type":"Domain","value":"story-tense-faz.sbs"},"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6":{"type":"File","value":"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6"}},"chains":[{"id":"sandbox_network","root":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","edges":[{"edge_kind":"contacted_domain","from_key":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","to_key":"Domain:blade-govern.sbs"},{"edge_kind":"contacted_domain","from_key":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","to_key":"Domain:disobey-curly.sbs"},{"edge_kind":"contacted_domain","from_key":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","to_key":"Domain:leg-sate-boat.sbs"},{"edge_kind":"contacted_domain","from_key":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","to_key":"Domain:motion-treesz.sbs"},{"edge_kind":"contacted_domain","from_key":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","to_key":"Domain:occupy-blushi.sbs"},{"edge_kind":"contacted_domain","from_key":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","to_key":"Domain:powerful-avoids.sbs"},{"edge_kind":"contacted_domain","from_key":"File:6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","to_key":"Domain:story-tense-faz.sbs"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":7,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","commodity","wacatac","credentialharvesting","lummastealer","criminal","informationstealer"],"sample_flags":["Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"6a96bb0d990f13b39a0bd515","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Packed.Themida","submit_name":"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","analysis_start_time":"2026-09-01T11:46:23+00:00","indicators_count":{"informative":62,"suspicious":21,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"67427d93bce2f6324c078e98","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"file","analysis_start_time":"2024-11-24T01:12:52+00:00","indicators_count":{"informative":50,"suspicious":12,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"blade-govern.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"domain":"disobey-curly.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"domain":"leg-sate-boat.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"domain":"motion-treesz.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"domain":"occupy-blushi.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"domain":"powerful-avoids.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"domain":"story-tense-faz.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}],"processes":[{"pid":6532,"ppid":0,"name":"file.exe","command_line":"","sha256":"6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6","normalized_path":"C:\\file.exe","uid":"00000000-00006532","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5008,"ppid":6532,"name":"WerFault.exe","command_line":"-u -p 6532 -s 760","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006532","uid":"00000000-00005008"},{"pid":7744,"ppid":6532,"name":"WerFault.exe","command_line":"-u -p 6532 -s 760","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006532","uid":"00000000-00007744"},{"pid":5012,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 6532 -ip 6532","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005012","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["windows.storage.dll","VxSSL32.dll","gdi32full.dll","shlwapi.dll","wow64win.dll","wow64cpu.dll","bcryptprimitives.dll","ucrtbase.dll","msvcp_win.dll","profapi.dll","ws2_32.dll","combase.dll","oleaut32.dll","wow64.dll","kernel32.dll","rpcrt4.dll","cryptbase.dll","cryptsp.dll","win32u.dll","winmmbase.dll","KernelBase.dll","gdi32.dll","imm32.dll","kernel.appcore.dll","user32.dll","advapi32.dll","msvcrt.dll","ole32.dll","cfgmgr32.dll","shell32.dll","powrprof.dll","ntdll.dll","apphelp.dll","sspicli.dll","sechost.dll","fltLib.dll","winmm.dll","SHCore.dll","msvcp140.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","WSHTCPIP.DLL","dnsapi.dll","api-ms-win-core-synch-l1-2-0.dll","mswsock.dll","FWPUCLNT.DLL","IPHLPAPI.DLL","winnsi.dll","usp10.dll","api-ms-win-core-processthreads-l1-1-1.dll","nsi.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","vcruntime140.dll","msctf.dll","schannel.dll","api-ms-win-crt-heap-l1-1-0.dll","crypt32.dll","webio.dll","lpk.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","winhttp.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","wshqos.dll","api-ms-win-crt-runtime-l1-1-0.dll","msasn1.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","credssp.dll","wship6.dll","rasadhlp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"},{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:6532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"name":"Local\\SM0:6532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"67427d93bce2f6324c078e98"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a96bb0d990f13b39a0bd515"}]}]}},"report_ids":{"sandbox_job_ids":["6a96bb0d990f13b39a0bd515","67427d93bce2f6324c078e98"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 6e05eacb5ba8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6e05eacb5ba8…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 6e05eacb5ba8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6e05eacb5ba8…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6e05eacb5ba89bf57cbe21ea64b9e8fb72148ecc6624c55e1f82aa2efcee03d6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 6e05eacb5ba8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6e05eacb5ba8…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]