26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.3448.Generic Sample 70367e0bfb4d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 70367e0bfb4d…. Malware family: Dacic.3448.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","keywords":["Malicious","Dacic.3448.Generic","malware analysis","sandbox report","threat intelligence","70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"],"about":{"@type":"SoftwareApplication","name":"Hesap_Hareketleri_20-07-2024.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.3448.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T137e,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "(ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "(ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject$get_SafeWaitHandle@" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BindHandle(FreeNativeOverlapped0GetNativeOverlappedStateLCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "(ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "(ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject$get_SafeWaitHandle@" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BindHandle(FreeNativeOverlapped0GetNativeOverlappedStateLCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")28:Taa9,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "*Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "Failed to get thread context GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Failed to get thread context Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "*Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")29:T11b4,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "6ThrowInvalidHandleExceptionRWaitForMultipleObjectsIgnoringSyncContext" (Indicator: "WaitForMultipleObjects"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "6ThrowInvalidHandleExceptionRWaitForMultipleObjectsIgnoringSyncContext" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")2a:T8f4,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ""LoadLibraryByName" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "FreeLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API ""LoadLibraryByName" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "FreeLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")2b:T44e,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")2c:T48a,"vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1006193586 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1006211942 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1006232299 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1011441048 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1011457260 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1011480729 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1012331726 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1012348094 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1012371753 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1013237930 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1013254888 [PID: 5872] "vbc.exe" queried SystemProcessInformation at 00000000-00005872-00000C15-1013278932 [PID: 5872]2d:T1328,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference "U6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found api reference ""BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found api reference "DecryptFileW" (Indicator: "DecryptFileW"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found api reference "EncryptFileW" (Indicator: "EncryptFileW"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found api reference "U6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found api reference ""BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "DecryptFileW" (Indicator: "DecryptFileW"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "EncryptFileW" (Indicator: "EncryptFileW"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")2e:T86a,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "U6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "U6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")2f:T13a6,Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-3425-0000000140067AA0 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-3425-0000000140067AA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3425-0000000140067AA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3425-0000000140067AA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-3427-0000000140064A50 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-3427-0000000140064A50 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3427-0000000140064A50 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3427-0000000140064A50 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-3430-0000000140064AF0 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-3430-0000000140064AF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3430-0000000140064AF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3430-0000000140064AF0 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-3585-0000000140002C70 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-3585-0000000140002C70 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3585-0000000140002C70 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3585-0000000140002C70 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-3772-0000000140012510 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-3772-0000000140012510 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3772-0000000140012510 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3772-0000000140012510 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-3818-000000014000B150 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-3818-000000014000B150 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3818-000000014000B150 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3818-000000014000B150 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-3820-000000014000AF40 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-3820-000000014000AF40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3820-000000014000AF40 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3820-000000014000AF40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-3992-000000014000C32F Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-3992-000000014000C32F Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-4087-0000000140012197 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-4087-0000000140012197 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-4089-0000000140012395 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-4089-0000000140012395 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-4108-0000000140012B4B Assembly shows XOR instruction xor eax esp in Stream UID: 19401-4108-0000000140012B4B Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-4108-0000000140012B4B Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-4108-0000000140012B4B Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-4804-0000000140064BE2 Assembly shows XOR instruction xor eax esp in Stream UID: 19401-4804-0000000140064BE2 Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-4811-00000001400666DC Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-4811-00000001400666DC Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-5062-000000014006C454 Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-5062-000000014006C454 Assembly shows XOR instruction xor rax rsp in Stream UID: 19401-5087-000000014006D74E Assembly shows XOR instruction xor eax esp in Stream UID: 19401-5087-000000014006D74E Assembly shows XOR instruction xor rcx rsp in Stream UID: 19401-5087-000000014006D74E Assembly shows XOR instruction xor ecx esp in Stream UID: 19401-5087-000000014006D74E Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 19401-12419-000000014006B601 Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 19401-12419-000000014006B601 Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 19401-12419-000000014006B601 Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 19401-12419-000000014006B601 Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 19401-12419-000000014006B601 Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 19401-12419-000000014006B601 Assembly shows XOR instruction xor rax rcx in Stream UID: 19401-12419-000000014006B601 Assembly shows XOR instruction xor eax ecx in Stream UID: 19401-12419-000000014006B60130:T8dd,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "DecryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "EncryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "Hg____PInvoke|9_0" (Indicator: "EncryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "Rg____PInvoke|11_0" (Indicator: "DecryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ""BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API "EncryptFileW" (Indicator: "EncryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0")31:T5da,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "DecryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "Rg____PInvoke|11_0" (Indicator: "DecryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "DecryptFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Rg____PInvoke|11_0" (Indicator: "DecryptFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")32:T4af,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Able to decrypt/decode data Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains cryptographic functions of the CryptoAPI33:T1388,Found XOR loop in file "sample.bin" at offset 120460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1630600; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1644133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1751656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1766224; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1789368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1850650; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1912465; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2047451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2188469; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 436816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 510077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 518041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 518054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 524623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 557564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 558212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 561681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 561762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 562873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 567606; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 568665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 569002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 570361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 570509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 570579; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 588307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 588393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 600089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 624233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 624490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 627521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 826762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 857418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 894608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 895317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 924413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 927962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 936371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1005460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1158414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1158513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1158647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1158746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1271337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1300320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1586536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2011767; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2028607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1574636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1595229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1604397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1621565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1634584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1693959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1700512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1700528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1708624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1708644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1708660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1732452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1743136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1759396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1787608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2003010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2024498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2086709; code bytes = 803034:Tb54,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ""GetLocaleInfoCore@" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API ":GetLocaleInfoCoreUserOverride@" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API "IcuGetLocaleInfo IcuGetTimeFormatString@" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API "$GetLocaleInfoExInt" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API "(NlsGetFirstDayOfWeek.GetLocaleInfoFromLCType" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@" (Indicator: "GetUserDefaultLocaleName"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "&GetLocaleInfoString" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$IsPredefinedLocale GetLocaleInfoInt" (Indicator: "GetLocaleInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ""GetLocaleInfoCore@" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API ":GetLocaleInfoCoreUserOverride@" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API "IcuGetLocaleInfo IcuGetTimeFormatString@" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API "$GetLocaleInfoExInt" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API "(NlsGetFirstDayOfWeek.GetLocaleInfoFromLCType" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "&GetLocaleInfoString" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "$IsPredefinedLocale GetLocaleInfoInt" (Indicator: "GetLocaleInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")35:T634,Found reference to API "EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "IcuGetLocaleInfo,IcuGetTimeFormatString@" (Indicator: "GetTimeFormat"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "*nativeEnumTimeFormats" (Indicator: "EnumTimeFormats"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "&InitCultureDataCore InitUserOverride$GetTimeFormatsCore@" (Indicator: "GetTimeFormat"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ""EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API "IcuGetLocaleInfo IcuGetTimeFormatString@" (Indicator: "GetTimeFormat"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API "*nativeEnumTimeFormats" (Indicator: "EnumTimeFormats"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API "&InitCultureDataCore InitUserOverride$GetTimeFormatsCore@" (Indicator: "GetTimeFormat"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API ""EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")36:T648,Found system information discovery API: "GetSystemInfo" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found system information discovery API: "ExpandEnvironmentStringsW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found system information discovery API: "*RtlNtStatusToDosError" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found system information discovery API: "0NtQuerySystemInformation" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found system information discovery API: "NtQuerySystemInformation" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found system information discovery API: "RtlNtStatusToDosError" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found system information discovery API: "*RtlNtStatusToDosError" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found system information discovery API: "0NtQuerySystemInformation" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"37:Tabe,"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac0194fd7f0000000000000000000051ed2495fd7f000000000000510100000000000000000000f1473b059eb200002a0000000000000050baa0e5510100008fec2495fd7f0000e0ac0194fd7f0000e0ac0194fd7f0000000000000000000000000000fd7f0000ffffff7f1eb0000000000000000000000000000000000000d8cef593fd7f00002a0000000000000069c3ae93fd7f00003100000000000000fc010000000000000002000000000000110001100000000030efbdb21b00000003a38492fd7f000030efbdb21b00000000000000000000002b00000000000000000000000000000020b0b493fd7f0000b43fb393fd7f0000e0cef593 (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006092)38:T52a,Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")39:T65b,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RtlGetVersionEx" (Indicator: "GetVersion"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "@g____PInvoke|22_0" (Indicator: "GetVersion"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "OSVersion's call to GetVersionEx failed." (Indicator: "GetVersion"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "RtlGetVersionEx" (Indicator: "GetVersion"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "@g____PInvoke|22_0" (Indicator: "GetVersion"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")3a:T4ed,Found registry modification API: "RegCreateKeyExW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry modification API: "$RegConnectRegistry" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry modification API: "RegCreateKeyEx" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry modification API: "Hg____PInvoke|1_0" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry modification API: "RegConnectRegistryW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry modification API: "$RegConnectRegistry" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry modification API: "RegCreateKeyEx" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry modification API: "Hg____PInvoke|1_0" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry modification API: "RegConnectRegistryW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"3b:Tc3c,"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter ZwWriteVirtualMemory (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00006092) "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00006092)3c:T109b,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "*Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject$get_SafeWaitHandle@" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "BindHandle(FreeNativeOverlapped0GetNativeOverlappedStateLCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "Failed to get thread context GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Failed to get thread context Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "*Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject$get_SafeWaitHandle@" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "BindHandle(FreeNativeOverlapped0GetNativeOverlappedStateLCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")3d:T426,"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd7c800000 "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd920a0000 "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd920a0000 "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd91600000 "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "USER32.DLL" at base 7ffd95040000 "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "SHELL32.DLL" at base 7ffd93a30000 "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "NTDLL.DLL" at base 7ffd95200000 "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffd915e00003e:T69e,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ""LoadLibraryByName" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API ""LoadLibraryByName" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")3f:Ta1e,"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "")40:T1058,"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "70367E0BFB4DE8097EBEF88D2A33D035DB64F84CC202E44E46C006EB87B937E0"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "")41:T759,"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "\Device\ConDrv\Server" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "\Device\ConDrv\\Reference" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "\Device\ConDrv\\Connect" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\BCRYPT.DLL" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\bcrypt.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\WINDOWS\SYSTEM32\bcrypt.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll"42:T43e,"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\BCRYPT.DLL" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\bcrypt.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\MSVCP140.DLL" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "vbc.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll"43:T8c2,Found registry query API: "RegQueryInfoKeyW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegEnumKeyExW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegOpenKeyExW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegQueryValueExW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegEnumValueW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegOpenKeyEx" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegEnumKeyEx" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegEnumValue" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegQueryInfoKey" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegQueryValueEx" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry query API: "RegOpenKeyEx" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegEnumKeyEx" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegEnumValue" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegQueryInfoKey" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"44:T654,Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")45:T484,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "FindClose,FindFirstFileExPrivate" (Indicator: "FindFirstFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "FindClose,FindFirstFileExPrivate" (Indicator: "FindFirstFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")46:Tb0c,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "Sleep:SetThreadPoolWorkerThreadName2ResetThreadPoolThreadSlow2GetCurrentProcessorNumber@" (Indicator: "GetCurrentProcess"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "6GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Sleep:SetThreadPoolWorkerThreadName2ResetThreadPoolThreadSlow2GetCurrentProcessorNumber@" (Indicator: "GetCurrentProcess"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "6GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")47:T488,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")48:Tcba,Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "GetFileAttributes"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "4GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "8GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API ",NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "Rg____PInvoke|17_0" (Indicator: "QueryInformationFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "GetFileAttributes"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "4GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "8GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API ",NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "Rg____PInvoke|17_0" (Indicator: "QueryInformationFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")49:T4f0,Found registry deletion API: "RegDeleteValueW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry deletion API: "RegDeleteKeyExW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry deletion API: "RegDeleteTreeW" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry deletion API: "RegDeleteKeyEx" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry deletion API: "RegDeleteTree" in file "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0" Found registry deletion API: "RegDeleteKeyEx" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry deletion API: "RegDeleteTree" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry deletion API: "RegDeleteValue" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00006092.00000000.127695.B3662000.00000002.mdmp"4a:T4dc,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "(LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "*AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "(LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "*AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")4b:Tc10,Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "RevertToSelf.GetSecurityInfoByHandle" (Indicator: "RevertToSelf"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "$CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "RevertToSelf.GetSecurityInfoByHandle" (Indicator: "RevertToSelf"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "$CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00006092.00000000.127695.B3662000.00000002.mdmp")4c:T481,Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0] Observed import api "GetWindowsAccountDomainSid" which can "receive a security identifier (SID) and returns a SID representing the domain of that SID" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0]4d:Tcf7,Found string "ReplaceFile" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: KERNEL32.DLL) Found string "SetFileTime" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: KERNELBASE.DLL) Found string "OpenProcess" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: KERNELBASE.DLL) Found string "VirtualAllocEx" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: KERNELBASE.DLL) Found string "GetTopWindow" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: USER32.DLL) Found string "GetSecurityInfo" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: ADVAPI32.DLL) Found string "SetSecurityInfo" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: ADVAPI32.DLL) Found string "DecryptFileW" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: ADVAPI32.DLL) Found string "EncryptFileW" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: ADVAPI32.DLL) Found string "GetNamedSecurityInfoW" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: ADVAPI32.DLL) Found string "NtQueryInformationFile" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: NTDLL.DLL) Found string "NtQuerySystemInformation" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: NTDLL.DLL) Found string "RegConnectRegistryW" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: ADVAPI32.DLL) Found string "RtlGetVersion" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: NTDLL.DLL) Found string "RtlNtStatusToDosError" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: NTDLL.DLL) Found string "SHGetKnownFolderPath" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: WINDOWS.STORAGE.DLL) Found string "SetActiveWindow" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: USER32.DLL) Found string "SetNamedSecurityInfoW" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: ADVAPI32.DLL) Found string "ShowWindow" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: USER32.DLL) Found string "ZwUnmapViewOfSection" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: NTDLL.DLL) Found string "ZwWriteVirtualMemory" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: NTDLL.DLL) Found string "IsWow64Process2" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0, API is part of module: KERNELBASE.DLL)4e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAJmZmZmZmQAAAAAAAAAABVmZmZmZmZmQAAAAAAAAAFWZmZmZmZmZlQAAAAAAAAVZmZmZmZmZmZmZAAAAAABVmZmZmZmZmZmZmZAAAAAFWZmZmZmZmZu7u7mZAAAAVVmZmZmZmbu7u7u7mbAABVWZmZmZmZO7u7u7u7mQAAVZmZmZmTVVVTu7u7u7kABVWZmZmZVVVVRFO7u7u7sAVZmZmZlVd1REREu7u7u7AFWZmZmZk7uzd0RHu7u7uwBVmZmZmbu7u7dERDu7u7u1WZmZmZk3dzN2ZmZ7u7u7tVmZmZmTVERmbMzMe7u7u7VZmZmZlURGbMzMzHu7u7u1WZmZmZVGbMzMzMZ7u7u7tVmZmZmTN8zMzMZmO7u7u7VZmZmZm7fMzGZmZru7u7sFWZmZmZu5dsZu7mu7u7u7AJmZmZmbuZt27ua7u7u7uwCZmZmZm7mbvu5ru7u7u7AACZmZmZuzdm7ue7u7u7uwAAmZmZmbtsbu7ru7u7u7AAAAWZmZmbfG7ua7u7u7uwAAAJmVV3c7du7mu7u7u7AAAACZlURsZ3bu5ru7u7uwAAAACZAEbMzG7u67u7u7AAAAAAmQAAzMxu7ue7u7sAAAAAAAAAAAAMZu7ru7sLAAAAAAAAAAAAAAAAALuwAAAAAAAAAAAAAAAAAAC7AAAAAAD/4AH//wAA//4AAH/8AAAf+AAAD/AAAAfgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAYAAAAGAAAADwAAAA8AAAAfgAAAH4AAAD+AAAA/zAAAf88AAP//4AL////H////z/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790611009267,"unified_at":"2026-09-28T15:56:49.267Z","metadata":{"hashes":{"sha256":"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","sha1":"7553310e59311ea2f7af36df7379ce513a42a33a","md5":"a3bef6ea366086e97cc6d5c57c211869","sha512":"1c29a2f279dd190fe575e5ce5f5c8ed3739b939d08f33a4b2b7d9f3d0d4409ed4e7e842424c5cd7c290552e94e5dd7b3dc598dce828e37f3e3c3bacb52638e0b","ssdeep":"49152:h2u/BMdg532rpsjCMqigjns2+a95PlpiH9MzMrcgt4h7NeiBAzD52:+rpEZIdBAnY","ssdeep_chunks":["49152:h2u/BMd","49152:2u/BMdg","49152:u/BMdg5","49152:/BMdg53","49152:BMdg532","49152:Mdg532r","49152:dg532rp","49152:g532rps","49152:532rpsj","49152:32rpsjC","49152:2rpsjCM","49152:rpsjCMq","49152:psjCMqi","49152:sjCMqig","49152:jCMqigj","49152:CMqigjn","49152:Mqigjns","49152:qigjns2","49152:igjns2+","49152:gjns2+a","49152:jns2+a9","49152:ns2+a95","49152:s2+a95P","49152:2+a95Pl","49152:+a95Plp","49152:a95Plpi","49152:95PlpiH","49152:5PlpiH9","49152:PlpiH9M","49152:lpiH9Mz","49152:piH9MzM","49152:iH9MzMr","49152:H9MzMrc","49152:9MzMrcg","49152:MzMrcgt","49152:zMrcgt4","49152:Mrcgt4h","49152:rcgt4h7","49152:cgt4h7N","49152:gt4h7Ne","49152:t4h7Nei","49152:4h7NeiB","49152:h7NeiBA","49152:7NeiBAz","49152:NeiBAzD","49152:eiBAzD5","49152:iBAzD52","98304:h2u/BMd","98304:2u/BMdg","98304:u/BMdg5","98304:/BMdg53","98304:BMdg532","98304:Mdg532r","98304:dg532rp","98304:g532rps","98304:532rpsj","98304:32rpsjC","98304:2rpsjCM","98304:rpsjCMq","98304:psjCMqi","98304:sjCMqig","98304:jCMqigj","98304:CMqigjn","98304:Mqigjns","98304:qigjns2","98304:igjns2+","98304:gjns2+a","98304:jns2+a9","98304:ns2+a95","98304:s2+a95P","98304:2+a95Pl","98304:+a95Plp","98304:a95Plpi","98304:95PlpiH","98304:5PlpiH9","98304:PlpiH9M","98304:lpiH9Mz","98304:piH9MzM","98304:iH9MzMr","98304:H9MzMrc","98304:9MzMrcg","98304:MzMrcgt","98304:zMrcgt4","98304:Mrcgt4h","98304:rcgt4h7","98304:cgt4h7N","98304:gt4h7Ne","98304:t4h7Nei","98304:4h7NeiB","98304:h7NeiBA","98304:7NeiBAz","98304:NeiBAzD","98304:eiBAzD5","98304:iBAzD52","49152:+rpEZId","49152:rpEZIdB","49152:pEZIdBA","49152:EZIdBAn","49152:ZIdBAnY"],"imphash":"bdd12e28ad568dc64eacd7cb42d8e2d5"},"file_info":{"file_name":"Hesap_Hareketleri_20-07-2024.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2222592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1721637336000,"last_seen":1788273920000,"last_multi_scan":1788273920000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":63},"sandbox_signatures":{"informative_count":147,"suspicious_count":16,"malicious_count":8,"total":171},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.RATX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.3448.4B37CA86","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Aotera-10060486-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.3448.4B37CA86 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Formbook.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.02290023","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/W64.Agent.fm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d43431 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Kryptik.GRZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PSWStealer.GZQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Bladabindi.Win32.31612","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dacic.3448.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"suspicious","value":"Contains ability to create directories"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to copy files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"suspicious","value":"Contains ability to retrieve volume information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Detected network traffic to commonly abused domain"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"},{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Trusted Developer Utilities Proxy Execution","attack_id":"T1127","attack_id_wiki":"https://attack.mitre.org/techniques/T1127","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"suspicious","value":"Contacts non-existent domain"},{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contacts random domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – AOT compiled .NET binary","description":"YARA signature match – AOT compiled .NET binary file \"sample.bin\"","origin":"Static Analysis","id":"yara-628","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zone\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\UT\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetFileTime\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ReplaceFile\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CopyFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"$CreateProcessClass[\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile6OpenHandleToWriteAttributes\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-449","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://aka.ms/globalizationinvariantmode\", Pattern match: \"https://aka.ms/nativeaot-compatibilit\", Heuristic match: \" .net\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.0.0.0\" found in string \"1.0.0.0\tR9R\n1.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"0RemoveDirectoryRecursive\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \".RemoveDirectoryInternal\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectory\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format string can be only \"G\", \"g\", \"X\", \"x\", \"F\", \"f\", \"D\" or \"d\"\" (Indicator: \"format \"; Source: \"sample.bin\"), Found string \"Format of the executable (.exe) or library (.dll) is invalid\" (Indicator: \"format \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1561.001","id":"string-407","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"@System.Security.Cryptography.dllBSystem.Security.Principal.Windows\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"AesBCryptModes\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \":System.Private.TypeLoader.dll8System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"TargetvM:System.Security.Cryptography.CryptoConfigForwarder.#cctor\nScope\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-84","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTim\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTim\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"\"GetLastAccessTime GetLastWriteTime GetAttributeData\" (Indicator: \"GetLastAccessTime\"; Source: \"sample.bin\"), Found reference to API \"\"GetLastAccessTime GetLastWriteTime GetAttributeData\" (Indicator: \"GetLastWriteTime\"; Source: \"sample.bin\"), Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"AesBCryptModes\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"TargetvM:System.Security.Cryptography.CryptoConfigForwarder.#cctor\nScope\" (Indicator: \"CryptoConfig\"; Source: \"sample.bin\"), Found reference to \"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089,CryptographicException2NotNullIfNotNullAttribute\" (Indicator: \"CryptographicException\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"SetLastAccessTime\"; Source: \"sample.bin\"), Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"SetLastWriteTime\"; Source: \"sample.bin\"), Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; Source: \"sample.bin\"), Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Invalid assembly public key\" (Indicator: \"public key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"TargetvM:System.Security.Cryptography.CryptoConfigForwarder.#cctor\nScope.AesBCryptModes.Decrypt@ThrowExceptionEncryptDecryptFail\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"Add-MpPreference -ExclusionPath $env:UserProfile\" (Indicator: \"add-mppreference\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"(ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"(ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"hydrated\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor@\" (Indicator: \"CreateDecryptor\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"CreateDecryptor@\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.04787","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$32","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$33","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\"), Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"OSVersion's call to GetVersionEx failed.\" (Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found string \"GetOSVersion&get_SystemDirectory4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool\" (Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006092)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006092)\n \"vbc.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005872)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006092)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@KERNEL32.dll at 19401-3621-0000000140012140\n GlobalMemoryStatusEx@KERNEL32.dll at 19401-3772-0000000140012510\n GlobalMemoryStatusEx@KERNEL32.dll at 19401-4087-0000000140012197\n GlobalMemoryStatusEx@KERNEL32.dll at 19401-4089-0000000140012395","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.dll at 19401-12267-000000014006AAD4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.dll at 19401-12260-000000014006AB58","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 19401-12419-000000014006B601","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 19401-12419-000000014006B601","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set unknown\" (Indicator: \"set \"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"(GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"(GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.dll at 19401-4108-0000000140012B4B\n OpenProcessToken@ADVAPI32.dll at 19401-12520-000000014006A990","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe\" - (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe\" - (UID: 00000000-00006092)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00006092)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"\"CreateFilePrivate\" (Indicator: \"CreateFile\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\"), Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\"), Found reference to API \"\"CreateFilePrivate\" (Indicator: \"CreateFile\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SleepEx@KERNEL32.dll at 19401-3529-00000001400129A0\n WaitForSingleObject@KERNEL32.dll at 19401-3770-0000000140012D00\n WaitForSingleObjectEx@KERNEL32.dll at 19401-3832-000000014006AC90\n WaitForMultipleObjectsEx@KERNEL32.dll at 19401-4007-000000014000C907","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.dll at 19401-3425-0000000140067AA0\n LoadLibraryExW@KERNEL32.dll at 19401-3585-0000000140002C70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow(SHGetKnownFolderPath\" (Indicator: \"ShowWindow\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"ShowWindow(SHGetKnownFolderPath\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process vbc.exe created mutex with name \"\\BaseNamedObjects\\J2RR056TX88-833B\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"y@system.gc.heapaffinitizeranges\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00006092.00000000.127695.B3662000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00006092.00000000.127695.B3662000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: 00000000-00006092.00000000.127695.B3662000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\\" in Source: 00000000-00006092.00000000.127695.B3662000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\UTC\" in Source: 00000000-00006092.00000000.127695.B3662000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00006092.00000000.127695.B3662000.00000002.mdmp\n \"System\\CurrentControlSet\\Control\\Nls\\Calendars\\Japanese\\Eras\" in Source: 00000000-00006092.00000000.127695.B3662000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 910B0000\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 91600000\n \"vbc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76CF0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 93030000\n \"vbc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76F30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has an executable section named \".text\"\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has an executable section named \".managed\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has an writable section named \"hydrated\"\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x14006b5e0,add\trsp, 0x28,jmp\t0x14006ae30,int3\t,int3\t,jmp\t0x14006b96c,int3\t,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x14006afe8,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x14006b013,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe\" [Source: 00000000-00006092-00000BC0-993669395]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe\" [Source: 00000000-00006092-00000BC0-994052509]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"ilasm.exe\" (UID: 00000000-00004692) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"ilasm.exe\" (UID: 00000000-00004692) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.adoniil.com\"\n \"www.censor.website\"\n \"www.cm123453.xyz\"\n \"www.dynamologistics.net\"\n \"www.gzy42.top\"\n \"www.self.apartments\"\n \"www.sysui.top\"\n \"www.xaj1699l08ws8.shop\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"ilasm.exe\" (UID: 00000000-00004692)\n Spawned process \"vbc.exe\" (UID: 00000000-00005872)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"ilasm.exe\" (UID: 00000000-00004692)\n Spawned process \"vbc.exe\" (UID: 00000000-00005872)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" queries basic process information of the \"C:\\70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" (UID: 6092)\n \"vbc.exe\" queries basic process information of the \"C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE\" (UID: 5872)\n \"vbc.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\MRINFO.EXE\" (UID: 5872)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"vbc.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005872)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" reads file \"c:\\70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://aka.ms/nativeaot-compatibility'\" - Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found URL \"https://aka.ms/nativeaot-compatibility(\" - Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found URL \"https://aka.ms/globalizationinvariantmode\" - Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"www.dynamologistics.net\" has high entropy\n Contacted domain: \"www.xaj1699l08ws8.shop\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersionEx\" (Indicator: \"RtlGetVersion\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"@g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"RtlGetVersionEx\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"@g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\"), Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"0GetProcAddressWithSuffix\" (Indicator: \"GetProcAddress\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"0GetProcAddressWithSuffix\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \",GetEnvironmentVariable4ExpandEnvironmentVariables\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"GetOSVersion&get_SystemDirectory4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"0SetFileAttributesPrivate\" (Indicator: \"SetFileAttributes\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"0SetFileAttributesPrivate\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006092.00000000.127695.B3662000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4c","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\ILASM.EXE\"; Value: \"\")\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\VBC.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has section name .rsrc with entropy \"7.548649964764854\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"vbc.exe queries ProcessDebugPort (UID: 5872)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 19401-3488-0000000140045940","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 19401-3810-000000014000C780","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve volume information","description":"GetVolumeInformationW@KERNEL32.dll at 19401-2992-000000014006ABA6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-130","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 19401-2997-000000014006AA5C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"SuspendThread@KERNEL32.dll at 19401-3585-0000000140002C70\n SetThreadContext@KERNEL32.dll at 19401-3880-000000014000CEC0\n GetThreadContext@KERNEL32.dll at 19401-3881-000000014000C9F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has resource with unusual entropy \"BINARY:7.999417312335001\"\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" has resource with unusual entropy \"RT_ICON:7.973224637360466\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Network Related","name":"Contacts non-existent domain","description":"Domain: \"www.cm123453.xyz\" uses a high-risk TLD and returned a failed connection\n Domain: \"www.dynamologistics.net\" uses a high-entropy naming patterns and returned a failed connection\n Domain: \"www.gzy42.top\" uses a high-risk TLD and returned a failed connection\n Domain: \"www.sysui.top\" uses a high-risk TLD and returned a failed connection\n Domain: \"www.xaj1699l08ws8.shop\" uses a high-entropy naming patterns and returned a failed connection","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-118","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Network Related","name":"Contacts random domain names","description":"\"www.cm123453.xyz\" seems to be random\n \"www.xaj1699l08ws8.shop\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Network Related","name":"Detected network traffic to commonly abused domain","description":"Domain: \"www.cm123453.xyz\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.\n Domain: \"www.gzy42.top\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.\n Domain: \"www.sysui.top\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.dll at 19401-2978-000000014006AC06","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0\" claimed CRC 2272862 while the actual is CRC 2255086","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteValueW\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyExW\n RegCloseKey\n RegCreateKeyExW\n OpenProcessToken\n GetLogicalDrives\n GetModuleHandleExW\n WriteFile\n SleepEx\n CreateThread\n CreateProcessA\n GetModuleHandleW\n VirtualAllocExNuma\n UnhandledExceptionFilter\n SleepConditionVariableCS\n GetModuleFileNameW\n GetProcAddress\n DeleteFileW\n GetFileAttributesExW\n FindNextFileW\n GetSystemDirectoryW\n Sleep\n FindFirstFileExW\n VirtualAlloc\n GetTickCount64\n DeviceIoControl\n CreateThreadpoolIo\n CreateFileW\n GetModuleHandleA\n CopyFileExW\n GetSystemInfo\n GetThreadContext\n TerminateProcess\n LoadLibraryExW\n CreateDirectoryW\n IsDebuggerPresent","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe\" - (UID: 00000000-00006092)\n \"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe\" - (UID: 00000000-00006092)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe\" - (UID: 00000000-00006092)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"vbc.exe\" set thread context in remote process \"%PROGRAMFILES%\\Microsoft Office\\Office14\\ONENOTEM.EXE\" (PID: 1044)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]}],"intel_graph":{"map":{"Domain:www.adoniil.com":{"type":"Domain","value":"www.adoniil.com"},"Domain:www.censor.website":{"type":"Domain","value":"www.censor.website"},"Domain:www.cm123453.xyz":{"type":"Domain","value":"www.cm123453.xyz"},"Domain:www.dynamologistics.net":{"type":"Domain","value":"www.dynamologistics.net"},"Domain:www.gzy42.top":{"type":"Domain","value":"www.gzy42.top"},"Domain:www.self.apartments":{"type":"Domain","value":"www.self.apartments"},"Domain:www.sysui.top":{"type":"Domain","value":"www.sysui.top"},"Domain:www.xaj1699l08ws8.shop":{"type":"Domain","value":"www.xaj1699l08ws8.shop"},"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0":{"type":"File","value":"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"}},"chains":[{"id":"sandbox_network","root":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","edges":[{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.adoniil.com"},{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.censor.website"},{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.cm123453.xyz"},{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.dynamologistics.net"},{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.gzy42.top"},{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.self.apartments"},{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.sysui.top"},{"edge_kind":"contacted_domain","from_key":"File:70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","to_key":"Domain:www.xaj1699l08ws8.shop"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":40,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":8,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a96e4ff11f924fba5095d4f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Dacic.3448","submit_name":"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","analysis_start_time":"2026-09-01T14:45:20+00:00","indicators_count":{"informative":142,"suspicious":34,"malicious":6},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"6a8312df4f66376db507222e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"Hesap_Hareketleri_20-07-2024.exe","analysis_start_time":"2026-08-17T13:55:43+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"www.adoniil.com","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"domain":"www.censor.website","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"domain":"www.cm123453.xyz","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"domain":"www.dynamologistics.net","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"domain":"www.gzy42.top","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"domain":"www.self.apartments","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"domain":"www.sysui.top","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]},{"domain":"www.xaj1699l08ws8.shop","country":"-","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}],"processes":[{"pid":6092,"ppid":0,"name":"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe","command_line":"","sha256":"70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0","normalized_path":"C:\\70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0.exe","uid":"00000000-00006092","icon":"$4e"},{"pid":4692,"ppid":6092,"name":"ilasm.exe","command_line":"","sha256":"624c22d02556db443659302bd59b3a2b2d8e48b000d60b600d663fe710b775fb","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe","parent_uid":"00000000-00006092","uid":"00000000-00004692"},{"pid":5872,"ppid":6092,"name":"vbc.exe","command_line":"","sha256":"466876f453563a272adb5d568670eca98d805e7ecaa5a2e18c92b6d3c947df93","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe","parent_uid":"00000000-00006092","uid":"00000000-00005872"}],"all_imported_dlls":["kernel32.dll","bcrypt.dll","msvcp_win.dll","fltLib.dll","sspicli.dll","ntdll.dll","apphelp.dll","combase.dll","bcryptprimitives.dll","VxSSL64.dll","msvcp140.dll","vcruntime140.dll","wow64win.dll","shell32.dll","cfgmgr32.dll","wow64cpu.dll","cryptbase.dll","shlwapi.dll","sechost.dll","ole32.dll","win32u.dll","ws2_32.dll","oleaut32.dll","SHCore.dll","windows.storage.dll","advapi32.dll","ucrtbase.dll","gdi32full.dll","powrprof.dll","profapi.dll","gdi32.dll","wow64.dll","msvcrt.dll","user32.dll","imm32.dll","kernel.appcore.dll","KernelBase.dll","rpcrt4.dll","vcruntime140_1.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\J2RR056TX88-833B","sources":[{"report_type":"sandbox","report_id":"6a96e4ff11f924fba5095d4f"}]}]}},"report_ids":{"sandbox_job_ids":["6a96e4ff11f924fba5095d4f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Dacic.3448.Generic Sample 70367e0bfb4d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 70367e0bfb4d…. Malware family: Dacic.3448.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"}],["$","meta","4",{"property":"og:title","content":"Malicious Dacic.3448.Generic Sample 70367e0bfb4d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 70367e0bfb4d…. Malware family: Dacic.3448.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/70367e0bfb4de8097ebef88d2a33d035db64f84cc202e44e46c006eb87b937e0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dacic.3448.Generic Sample 70367e0bfb4d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 70367e0bfb4d…. Malware family: Dacic.3448.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]