21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Virus.Floxif Sample 74e50e20c15b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 74e50e20c15b…. Malware family: Virus.Floxif. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c","keywords":["Malicious","Virus.Floxif","malware analysis","sandbox report","threat intelligence","74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c"],"about":{"@type":"SoftwareApplication","name":"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin","applicationCategory":["pedll","executable"],"identifier":"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Virus.Floxif","antivirusDetections":{"malicious":18,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAHd3AAAAAAAAAAAAAAAAAAd3cAd3AAAHcAAHAAAAAAB4/4h3cAB3d4iHcAcAAAAHiP////h3d4iP//hwcAAACIj////4h4iIiI//9wcAAIiI/4J4iIeIiIiI//9wcACIiP+CIiJ4iIiIiP//hwAAiIiPgqIiiIiIiIj///gHAIj4j4qqJ4iIiI//////cACI+I+KOieIiIj4j////3CAiPiPg6ooiIiPh3j///+AgIj/j4qjKIiIj4j3////gICI//iIi7iIiI+Ih4+IiICAiP/4i7u3iIj/+Hj4iIiAgIj/+Iu7t4////+P+IiIhwCIiPiIiLOP////+IiIiHcAiOj4iIiIf///+IiIiIhwAIjn+IiIiIj///iIiIiHcACIZ/iIiIiHj//4iIiIhwAAiIj4iIiIiHj//4iIiHAAAIiIju7u7uiHiP//iIgAAACIiI7/+IiO7uZ4iHgAAAAAiP+P////+IiI7ucAcAAAAI//iIj/////+IiIh3AAAACI+Hd3eIiIiPiIiIgAAAAAiPh3d3d3iIiP//hwAAAAAI/4iIiIiIiI///4AAAAAAj/+IiIiIiIiI///3cAAAAI+IiIiIiIiIiP//9wAAAACIiIiIiIiIiIeP//hwAAAACIiIiIiIiIiHj/iIgAAAAAAAAAAAiIiIgAiIgAAAAAD4f///8AfAf+AAAB/AAAAPwAAAB4AAAAOAAAADgAAAAYAAAAGAAAAAgAAAAIAAAACAAAAAgAAAAIAAAAGAAAABgAAAA4AAAAOAAAAHgAAAD4AAAB+AAAB/gAAAP4AAAD+AAAB/gAAA/4AAAP8AAAB/AAAAfwAAAH+AAAB//8Bh/w==23:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAHd3AAAAAAAAAAAAAAAAAAd3cAd3AAAHcAAHAAAAAAB4/4h3cAB3d4iHcAcAAAAHiP////h3d4iP//hwcAAACIj////4h4iIiI//9wcAAIiI/4J4iIeIiIiI//9wcACIiP+CIiJ4iIiIiP//hwAAiIiPgqIiiIiIiIj///gHAIj4j4qqJ4iIiI//////cACI+I+KOieIiIj4j////3CAiPiPg6ooiIiPh3j///+AgIj/j4qjKIiIj4j3////gICI//iIi7iIiI+Ih4+IiICAiP/4i7u3iIj/+Hj4iIiAgIj/+Iu7t4////+P+IiIhwCIiPiIiLOP////+IiIiHcAiOj4iIiIf///+IiIiIhwAIjn+IiIiIj///iIiIiHcACIZ/iIiIiHj//4iIiIhwAAiIj4iIiIiHj//4iIiHAAAIiIju7u7uiHiP//iIgAAACIiI7/+IiO7uZ4iHgAAAAAiP+P////+IiI7ucAcAAAAI//iIj/////+IiIh3AAAACI+Hd3eIiIiPiIiIgAAAAAiPh3d3d3iIiP//hwAAAAAI/4iIiIiIiI///4AAAAAAj/+IiIiIiIiI///3cAAAAI+IiIiIiIiIiP//9wAAAACIiIiIiIiIiIeP//hwAAAACIiIiIiIiIiHj/iIgAAAAAAAAAAAiIiIgAiIgAAAAAD4f///8AfAf+AAAB/AAAAPwAAAB4AAAAOAAAADgAAAAYAAAAGAAAAAgAAAAIAAAACAAAAAgAAAAIAAAAGAAAABgAAAA4AAAAOAAAAHgAAAD4AAAB+AAAB/gAAAP4AAAD+AAAB/gAAA/4AAAP8AAAB/AAAAfwAAAH+AAAB//8Bh/w==24:Tf65,Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin")25:T440,Found string "" (Indicator: "LogonTrigger"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string " true" (Indicator: "LogonTrigger"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") file/memory contains long string with (Indicator: "BootTrigger"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "LogonTrigger>" (Indicator: "LogonTrigger"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "" (Indicator: "LogonTrigger"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "" (Indicator: "LogonTrigger"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "" (Indicator: "BootTrigger"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "" (Indicator: "BootTrigger"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")26:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")27:T1262,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[DO][WaitForSingleObject failed][Last error: %d]" (Indicator: "WaitForSingleObject"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[DO][WaitForSingleObject failed][Result: %#x]" (Indicator: "WaitForSingleObject"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[WaitForSingleObject failed][%d]" (Indicator: "WaitForSingleObject"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[LaunchCopilotRepair][WaitForSingleObject failed][%u][%u]" (Indicator: "WaitForSingleObject"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[DO][WaitForSingleObject failed][Last error: %d]" (Indicator: "WaitForSingleObject"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[DO][WaitForSingleObject failed][Result: %#x]" (Indicator: "WaitForSingleObject"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[WaitForSingleObject failed][%d]" (Indicator: "WaitForSingleObject"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[LaunchCopilotRepair][WaitForSingleObject failed][%u][%u]" (Indicator: "WaitForSingleObject"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")28:T74b,Heuristic match: "base\logging.cc" Heuristic match: "d:\a\_work\1\omaha\src\third_party\breakpad\src\processor\minidump.cc" Heuristic match: "d:\a\_work\1\omaha\src\third_party\breakpad\src\processor\basic_code_modules.cc" Heuristic match: "d:\a\_work\1\omaha\src\third_party\breakpad\src\processor\proc_maps_linux.cc" Heuristic match: "eventinfo.name" Pattern match: "https://self.events.data.microsoft.com/onecollector/1.0/" Heuristic match: "deviceinfo.id" Heuristic match: "appinfo.id" Heuristic match: "appinfo.name" Heuristic match: "userinfo.id" Heuristic match: "aggregatedmetric.name" Heuristic match: "failure.id" Heuristic match: "pageview.id" Heuristic match: "pageview.name" Heuristic match: "pageaction.targetitemdatasource.name" Heuristic match: "sampledmetric.name" Heuristic match: "state.name" Heuristic match: "session.id" Pattern match: "https://msedge.api.cdp.microsoft.com/api" Pattern match: "https://config.edge.skype.com/config/v1/edgeupdate" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2068169&" Pattern match: "https://to-be-replaced.invalid/cr/report" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2111568&" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2348704&" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "https://msedgesetup.microsoft.com/products" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2109631" Pattern match: "api.cdp.microsoft.com/api" Pattern match: "ype.com/config/v1/edgeupdate" Pattern match: "ft.com/fwlink/?linkid=2111568&" Heuristic match: "\_work\1\omaha\src\third_party\breakpad\src\processor\minidump.cc" Pattern match: "sedgesetup.microsoft.com/products" Pattern match: "go.microsoft.com/fwlink/?linkid=2109631" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "gn.cy"29:T5cb,"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.951638875861591" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.967707366301325" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.964371119070208" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.937395555517319" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.900289265321798" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.920785642843067" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.904047809808844" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.8887113341140385" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.7348641401901075" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.92542657690709" "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" has resource with unusual entropy "RT_ICON:7.94539503440653"2a:T804,Found reference to API "LockResource" (Indicator: "LockResource"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[InitializeGoopdateAndLoadResources failed][0x%08x]" (Indicator: "LoadResource"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[InitializeGoopdateAndLoadResources failed][0x%08x]" (Indicator: "LoadResource"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")2b:T416,Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005884.00000001.200933.010E9000.00000002.mdmp")2c:T53e,Found reference to API "WTSEnumerateSessionsW" (Indicator: "WTSEnumerateSessions"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[GetLogonTime WTSQuerySessionInformation failed][0x%x]" (Indicator: "WTSQuerySessionInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[GetLogonTime WTSQuerySessionInformation failed][0x%x]" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WTSEnumerateSessionsW" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")2d:T4d4,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")2e:T52c,Found string "Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")2f:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")30:T1316,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "UATriggeredByInternetConnectivity" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][ResourceManager::Create][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EcsUATriggeredByInternetConnectivityError" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InternetConnectivity error][ResourceManager::Create][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "dString][Old UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "ForMode][UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "opdateTaskForMode][UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin")31:T470,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")32:T1c14,"SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKU\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Classes" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Google\Update" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Google\Update\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Google\Update\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\proxy" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\http\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\Applications\chrome.exe\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "\SOFTWARE\Classes" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\CLSID\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp33:T1089,Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpCreateUrl" (Indicator: "WinHttpCreateUrl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpCheckPlatform" (Indicator: "WinHttpCheckPlatform"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpDetectAutoProxyConfigUrl" (Indicator: "WinHttpDetectAutoProxyConfigUrl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSetDefaultProxyConfiguration" (Indicator: "WinHttpSetDefaultProxyConfiguration"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin")34:T546,Found string "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")35:T6ba,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")36:T3cea,"SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\%ws\UsageStats\Daily" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Classes" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\EdgeUpdate\Clients\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Google\Update" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Google\Update\Clients\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Google\Update\ClientState\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\EdgeUpdate\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "Software\Microsoft\EdgeUpdate\proxy" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "SOFTWARE\Clients\StartMenuInternet" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCR\http\shell\open\command" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCR\Applications\chrome.exe\shell\open\command" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "SOFTWARE\Microsoft\SQMClient" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "\SOFTWARE\Classes" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCR\CLSID\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 7448-7860-18086CBA "\Software\Microsoft\EdgeUpdateDev\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "\Software\Microsoft\" in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKU\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Setup\State" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Policies\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Policies\Microsoft\Copilot" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\DownloaderLockout" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\CdpNames\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdateDev\AdditionalInstallArgs\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Classes" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Google\Update" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Google\Update\Clients\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Google\Update\ClientState\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\%s" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "Software\Microsoft\EdgeUpdate\proxy" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\http\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\Applications\FIREFOX.EXE\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\Applications\chrome.exe\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Microsoft\SQMClient" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "\SOFTWARE\Classes" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCR\CLSID\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\Software\Microsoft\" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp37:T648,"HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "KLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00005884.00000000.200784.72BDA000.00000002.mdmp38:T57c,Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")39:T606,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[CreateMutex failed][%s][0x%08x]" (Indicator: "CreateMutex"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[CreateMutex failed][%s][0x%08x]" (Indicator: "CreateMutex"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")3a:T662,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[::TerminateProcess succeeded][%u]" (Indicator: "TerminateProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[::TerminateProcess failed][%u][%u]" (Indicator: "TerminateProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[::TerminateProcess succeeded][%u]" (Indicator: "TerminateProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[::TerminateProcess failed][%u][%u]" (Indicator: "TerminateProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp")3b:T9cb,Found reference to API "[WaitForEULAAccepted][Give up: Shutdown event set]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[WaitForOOBEConnectivity][Give up: Shutdown event set]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Failed to set shutdown event][0x%08x]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Failed to create shutdown event][0x%08x]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Another core instance is already running at log on. Sending shutdown event.]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Other Omaha Update instances failed to shutdown in time][%u]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "vity][Give up: Shutdown event set]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "ance is already running at log on. Sending shutdown event.]" (Indicator: " shutdown "; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[WaitForEULAAccepted][Give up: Shutdown event set]" (Indicator: " shutdown "; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[WaitForOOBEConnectivity][Give up: Shutdown event set]" (Indicator: " shutdown "; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Failed to set shutdown event][0x%08x]" (Indicator: " shutdown "; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Failed to create shutdown event][0x%08x]" (Indicator: " shutdown "; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Another core instance is already running at log on. Sending shutdown event.]" (Indicator: " shutdown "; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Other Omaha Update instances failed to shutdown in time][%u]" (Indicator: " shutdown "; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")3c:T1883,Found XOR loop in file "sample.bin" at offset 536511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 537198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 537275; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 825541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1483289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1756756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1761284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2105295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2249579; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2253801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2260915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2277917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2286267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2286971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2306195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2307923; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2309979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2312035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2313885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2314675; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2318493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2318683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2387141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 121792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 361028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 378440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 416107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 416259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 486945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1053066; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1053907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1054011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1086046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1096849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1096992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1097061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1097127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1203422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1293297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2056059; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2126815; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2134125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2246251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2247435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2248747; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2250377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2252157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2268723; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2271155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2277951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2281919; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2293381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2299451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2353500; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 335012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 442849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 872185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1514264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1526252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1538602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2047297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2070269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2126073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2130519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2249386; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2253800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2263666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2266452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2268418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2272446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2273744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2280794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2283066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2291802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2293772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2302148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2304924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2306908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2307884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2309940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2311996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2314660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2316480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2318644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2325350; code bytes = 80303d:T532,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005884.00000001.200933.03600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005884.00000001.200933.03600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005884.00000001.200933.03600000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005884.00000001.200933.03600000.00000004.mdmp")3e:T4bc,Found reference to API "StartServiceW" (Indicator: "StartService"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[StartService]" (Indicator: "StartService"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[StartService]" (Indicator: "StartService"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")3f:T121f,Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "UATriggeredByInternetConnectivity" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][ResourceManager::Create][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EcsUATriggeredByInternetConnectivityError" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "InternetConnectivity error][ResourceManager::Create][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "dString][Old UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "ForMode][UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "opdateTaskForMode][UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "UATriggeredByInternetConnectivity" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][ResourceManager::Create][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "EcsUATriggeredByInternetConnectivityError" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Ping::SendString][New UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[Ping::SendString][Old UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity not present]" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "[InstallGoopdateTaskForMode][UATriggeredByInternetConnectivity error][0x%08x]" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")40:Tfd2,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[EnumProcesses failed][%u]" (Indicator: "EnumProcesses"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[EnumProcesses failed][%u]" (Indicator: "EnumProcesses"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")41:T7d2,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")42:T447,Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "OutputDebugStringA" (Indicator: "OutputDebugString"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin")43:T712,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")44:T5a8,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")45:T12db,"rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005884) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005884)46:T530,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")47:T759,Found system information discovery API: "GetSystemInfo" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found system information discovery API: "GetNativeSystemInfo" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found system information discovery API: "ExpandEnvironmentStringsW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found system information discovery API: "ExpandEnvironmentStringsForUserW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found system information discovery API: "GetMonitorInfoW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsForUserW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005884.00000001.200933.010E9000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005884.00000001.200933.010E9000.00000002.mdmp"48:T592,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")49:T738,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")4a:T47a,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")4b:T10d8,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "LOG_SYSTEM: ERROR - [::GetFileInformationByHandle failed][%d]" (Indicator: "GetFileInformationByHandle"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "LOG_SYSTEM: ERROR - [::GetFileInformationByHandle failed][%d]" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")4c:Td88,Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[GetLogonTime WTSQuerySessionInformation failed][0x%x]" (Indicator: "WTSQuerySessionInformation"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "[GetLogonTime WTSQuerySessionInformation failed][0x%x]" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00005884.00000001.200933.010E9000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005884.00000001.200933.010E9000.00000002.mdmp")4d:T74a,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")4e:T1032,Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-150-181558C1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-150-181558C1 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-284-1815DFF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-284-1815DFF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-1375-1800AA03 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-1375-1800AA03 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-1394-1801C786 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-1394-1801C786 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-5980-1815C400 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-5980-1815C400 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-5982-1815C1A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-5982-1815C1A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-5985-18157002 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-5985-18157002 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6023-1814BF70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6023-1814BF70 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6275-18155317 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6275-18155317 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6288-1815563C Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6288-1815563C Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6408-1811B87F Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6408-1811B87F Assembly shows XOR instruction xor eax esp in Stream UID: 7448-6409-1808760F Assembly shows XOR instruction xor ecx esp in Stream UID: 7448-6409-1808760F Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6421-18118DD2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6421-18118DD2 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6427-1811B2B2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6427-1811B2B2 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6503-18046A89 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6503-18046A89 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6504-1804688D Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6504-1804688D Assembly shows XOR instruction xor eax esp in Stream UID: 7448-6512-18116E90 Assembly shows XOR instruction xor ecx esp in Stream UID: 7448-6512-18116E90 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6520-181165DE Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6520-181165DE Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6526-18115AB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6526-18115AB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6529-18115830 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6529-18115830 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6538-18114E00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6538-18114E00 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-6561-181143C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-6561-181143C0 Assembly shows XOR instruction xor eax esp in Stream UID: 7448-6588-18113450 Assembly shows XOR instruction xor eax dword ptr [ebx+000000A4h] in Stream UID: 7448-6588-18113450 Assembly shows XOR instruction xor dword ptr [ebx+000000A4h] eax in Stream UID: 7448-6588-18113450 Assembly shows XOR instruction xor ecx esp in Stream UID: 7448-6588-18113450 Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-7001-181001EF Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-7001-181001EF Assembly shows XOR instruction xor eax ebp in Stream UID: 7448-7146-180E81BB Assembly shows XOR instruction xor ecx ebp in Stream UID: 7448-7146-180E81BB4f:T4ca,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp")50:T9f7,Found registry query API: "RegOpenKeyTransactedW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "SHQueryValueExW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegQueryValueExW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegOpenKeyExW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegEnumKeyW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegEnumValueW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegEnumKeyExW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegQueryInfoKeyW" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegNotifyChangeKeyValue" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegOpenCurrentUser" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegGetValueA" in file "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "SHQueryValueExW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegOpenCurrentUser" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00005884.00000000.200784.72BDA000.00000002.mdmp"51:T53d,SleepConditionVariableCS@KERNEL32.dll at 7448-5966-18162A20 SleepConditionVariableSRW@KERNEL32.dll at 7448-5969-18162A40 Sleep@KERNEL32.dll at 7448-7004-180F6150 Sleep@KERNEL32.dll at 7448-7184-180E6E20 WaitForSingleObject@KERNEL32.dll at 7448-7333-180838DD WaitForSingleObject@KERNEL32.dll at 7448-7346-18015B0E WaitForMultipleObjects@KERNEL32.dll at 7448-7439-180D3CE0 WaitForSingleObject@KERNEL32.dll at 7448-8193-180851D4 WaitForSingleObject@KERNEL32.dll at 7448-8215-18084B62 WaitForSingleObject@KERNEL32.dll at 7448-8252-1807D6D9 WaitForMultipleObjects@KERNEL32.dll at 7448-8314-1807B121 Sleep@KERNEL32.dll at 7448-8430-18076150 WaitForSingleObject@KERNEL32.dll at 7448-8437-180874FB WaitForSingleObject@KERNEL32.dll at 7448-8526-18072DE0 WaitForSingleObject@KERNEL32.dll at 7448-8599-18071FCD Sleep@KERNEL32.dll at 7448-8726-18070889 WaitForSingleObject@KERNEL32.dll at 7448-8735-18017B17 WaitForMultipleObjectsEx@KERNEL32.dll at 7448-8745-18017B34 WaitForSingleObject@KERNEL32.dll at 7448-9025-1804FBB0 WaitForSingleObject@KERNEL32.dll at 7448-9180-18045830 Sleep@KERNEL32.dll at 7448-9190-1804545C WaitForSingleObject@KERNEL32.dll at 7448-9194-18045748 WaitForSingleObject@KERNEL32.dll at 7448-9435-18009BEE Sleep@KERNEL32.dll at 7448-9462-18015A70 WaitForMultipleObjectsEx@KERNEL32.dll at 7448-9489-1808885918:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["pioneer"],"file_activity":{"dropped_files":[],"extracted_files":[],"files_deleted":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["cfgmgr32.dll","sfc.dll","wow64win.dll","gdi32full.dll","bcryptprimitives.dll","wow64cpu.dll","win32u.dll","imagehlp.dll","profapi.dll","bcrypt.dll","imm32.dll","VxSSL32.dll","powrprof.dll","cryptsp.dll","wow64.dll","oleaut32.dll","setupapi.dll","kernel32.dll","sspicli.dll","ws2_32.dll","74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin.dll","shlwapi.dll","fltLib.dll","msvcrt.dll","combase.dll","ole32.dll","mpr.dll","ucrtbase.dll","rpcrt4.dll","shell32.dll","SHCore.dll","cryptbase.dll","kernel.appcore.dll","sfc_os.dll","AcLayers.dll","IPHLPAPI.DLL","KernelBase.dll","gdi32.dll","apphelp.dll","windows.storage.dll","sechost.dll","user32.dll","ntdll.dll","advapi32.dll","msvcp_win.dll"],"processes":[{"command_line":"","name":"","normalized_path":"","pid":5844,"ppid":0,"uid":"00000000-00005844"},{"command_line":"\"C:\\74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin.dll\",#1","icon":"$22","name":"rundll32.exe","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","pid":5884,"ppid":0,"sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","uid":"00000000-00005884"},{"command_line":"-u -p 5884 -s 660","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005884","pid":6856,"ppid":5884,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006856"},{"command_line":"-u -p 5884 -s 660","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005884","pid":6092,"ppid":5884,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006092"},{"command_line":"-u -p 5884 -s 660","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005884","pid":5392,"ppid":5884,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005392"},{"command_line":"-pss -s 440 -p 5884 -ip 5884","icon":"$23","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":5220,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005220"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Sample Crashed"],"sandbox_reports":[{"analysis_start_time":"2026-03-23T01:26:28+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"69c096c233989cdd2a0edf68","indicators_count":{"informative":197,"malicious":4,"suspicious":22},"is_in_unified_schema":true,"malware_family":"Floxif.A","state":"SUCCESS","submit_name":"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin","tags":["Multi-Process","Sample Crashed"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":0,"files_deleted_count":0,"files_written_count":1,"http_requests_count":0,"imported_dlls_count":45,"injected_processes_count":0,"mutex_created_count":0,"process_count":6,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":6}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Virus.Floxif"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win32/Fixflo.GEN","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Virus/Win32.Pioneer.cz","verdict":"malicious"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Infector.Gen4","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win32.Floxif.A","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win.Virus.Pioneer-9111434-0","verdict":"malicious"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win32.Floxif.A (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win32/Floxif.H virus","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Suspicious:W32.Pioneer.cz.fpia.dll.mg","verdict":"malicious"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Virus/Floxif.gen$TA","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Virus ( 00521e9a1 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Floxif-C","verdict":"malicious"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Dropper-FIY!2C020F40CAE7","verdict":"malicious"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Floxif.B","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win32.FloodFix.A","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_52.3","verdict":"malicious"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Virus.Win32.Floxif.A","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Virus.Floxif.Win32.1","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"suspicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task/Job"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Windows Credential Manager"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"PE file contains large number of import functions"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"},{"type":"informative","value":"Contains ability to perform remote desktop activity"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Desktop Protocol"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Rundll32"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"Internet Connection Discovery"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to enumerate logon sessions"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"},{"type":"informative","value":"Contains ability to retrieve remote session information"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up multiple procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"$24","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$25","id":"string-32","level":"suspicious","mitre_attack_id":"T1053","name":"Found an indicator for a scheduled task trigger","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"GetVersionExW\n LockResource\n GetModuleHandleExW\n CopyFileW\n GetFileSizeEx\n WriteFile\n OutputDebugStringW\n DeviceIoControl\n GetComputerNameExW\n OpenProcess\n FindResourceW\n GetFileAttributesExW\n GetModuleFileNameA\n CreateFileW\n CreateThread\n GetTempPathW\n GetDriveTypeW\n LoadLibraryW\n GetCommandLineW\n GetSystemInfo\n IsDebuggerPresent\n GetProcAddress\n TerminateProcess\n CreateToolhelp32Snapshot\n SleepConditionVariableSRW\n GetTickCount64\n UnhandledExceptionFilter\n CreateDirectoryW\n GetCommandLineA\n GetStartupInfoW\n SleepConditionVariableCS\n Process32NextW\n LoadLibraryExA\n FindFirstFileExW\n FindNextFileW\n Sleep\n OutputDebugStringA\n ReadProcessMemory\n DeleteFileW\n LoadLibraryExW\n GetTickCount\n GetTempFileNameW\n CreateProcessW\n Process32FirstW\n VirtualProtect\n GetModuleHandleW\n GetSystemDirectoryW\n GetNativeSystemInfo\n FindFirstFileW\n GetFileSize\n GetFileAttributesW\n VirtualAlloc\n FindResourceExW\n GetModuleFileNameW\n ExitThread","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"LoadLibraryExA@KERNEL32.dll at 7448-5954-18160A2E\n LoadLibraryW@KERNEL32.dll at 7448-9440-1800D254\n LoadLibraryExW@KERNEL32.dll at 7448-9482-18025772\n LoadLibraryExW@KERNEL32.dll at 7448-9589-1808BB74\n LoadLibraryExW@KERNEL32.dll at 7448-9753-180672EA","id":"stream-108","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to dynamically load libraries","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"WTSFreeMemory@WTSAPI32.dll at 7448-8253-1801B82D","id":"stream-137","level":"informative","mitre_attack_id":"T1021.001","name":"Contains ability to perform remote desktop activity","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-413","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to find open windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS url \"https://self.events.data.microsoft.com\"\n Found HTTPS url \"https://msedge.api.cdp.microsoft.com\"\n Found HTTPS url \"https://config.edge.skype.com\"\n Found HTTPS url \"https://go.microsoft.com\"\n Found HTTPS url \"https://to\"\n Found HTTPS url \"https://msedgesetup.microsoft.com\"","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"WTSEnumerateSessionsW@WTSAPI32.dll at 7448-8253-1801B82D","id":"stream-120","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate logon sessions","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"[Ping::Send did not send since ping is deferred]\" (Indicator: \"ping\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"end did not send since ping is deferred]\" (Indicator: \"ping\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"[Ping::Send did not send since ping is deferred]\" (Indicator: \"ping\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemInfo@KERNEL32.dll at 7448-5959-18160874\n GetSystemInfo@KERNEL32.dll at 7448-10548-18142945","id":"stream-86","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system","origin":"Hybrid Analysis Technology","relevance":4,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin.dll\",#1\" (UID: 00000000-00005884)","id":"target-400","level":"informative","mitre_attack_id":"T1218.011","name":"Executes a DLL using Rundll32 process","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$26","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found registry deletion API: \"RegDeleteKeyTransactedW\" in file \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\"\n Found registry deletion API: \"RegDeleteKeyExW\" in file \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\"\n Found registry deletion API: \"RegDeleteKeyTransactedW\" in \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\"","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-402","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to modify process attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string - ^\\d+\\.\\d+$; Source: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string - ^\\d+\\.\\d+$; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Able to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-906","level":"informative","mitre_attack_id":"T1057","name":"Able to list processes on remote desktop session host","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetLocaleInfoW@KERNEL32.dll at 7448-5980-1815C400\n GetLocaleInfoW@KERNEL32.dll at 7448-5981-1815C62C\n GetLocaleInfoW@KERNEL32.dll at 7448-5982-1815C1A0","id":"stream-49","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query the system locale","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","id":"target-2","level":"informative","name":"An application crash occurred","origin":"Monitored Target","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" contains export function called \"DllEntry\" at ordinal 1","id":"static-78","level":"informative","name":"Contains export functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"rundll32.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76cc0000\n \"rundll32.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76cc0000\n \"rundll32.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76cc0000\n \"rundll32.exe\" loaded module \"KERNEL32\" at base 76ea0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 72cb0000\n \"rundll32.exe\" loaded module \"EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL\" at base 76ea0000","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Potential IP \"3.4.254.1\" found in string \"EVT-Windows-C++-No-3.4.254.1\"\n \"0.0.0.0\"\n \"1.3.225.7\"\n \"1.3.99.0\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$27","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-140","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to verify if file exist on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin]","id":"static-194","level":"informative","mitre_attack_id":"T1016","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"$28","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"WTSEnumerateSessionsW@WTSAPI32.dll at 7448-8253-1801B82D","id":"stream-138","level":"informative","mitre_attack_id":"T1018","name":"Contains ability to retrieve remote session information","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"[File::OpenShareMode - SetFileAttributes failed][0x%x]\" (Indicator: \"SetFileAttributes\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"[File::OpenShareMode - SetFileAttributes failed][0x%x]\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$29","id":"static-92","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy resources","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 7448-6244-18126543","id":"stream-4","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F00000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73220000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" was detected as \"MEW\" and name: \"Packer\"\n \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-117","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate logon sessions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-118","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to query network adapter information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-227","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about MS-DOS device names (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 5884 -ip 5884\" (UID: 00000000-00005220)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5884 -s 660\" (UID: 00000000-00006856)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5884 -s 660\" (UID: 00000000-00006092)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5884 -s 660\" (UID: 00000000-00005392)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-108","level":"informative","mitre_attack_id":"T1486","name":"Contains ability to perform encryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetProcessHeap@KERNEL32.dll at 7448-5990-181564B0\n OpenProcess@KERNEL32.dll at 7448-7409-180D5580\n OpenProcess@KERNEL32.dll at 7448-7446-180D2C90\n OpenProcess@KERNEL32.dll at 7448-8655-1806CB80\n OpenProcess@KERNEL32.dll at 7448-9467-18018435\n OpenProcess@KERNEL32.dll at 7448-9490-18088B21\n OpenProcess@KERNEL32.dll at 7448-10044-180865E2","id":"stream-31","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-884","level":"informative","mitre_attack_id":"T1083","name":"Able to rename or move file/directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"[Failed to ::ShellExecuteEx][%s][%s][0x%08x]\" (Indicator: \"ShellExecute\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"[Failed to ::ShellExecuteEx][%s][%s][0x%08x]\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00005884.00000001.200933.03600000.00000004.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-314","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve internet settings (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"TerminateProcess@KERNEL32.dll at 7448-7458-180D1290\n ExitProcess@KERNEL32.dll at 7448-9450-180117D3\n TerminateProcess@KERNEL32.dll at 7448-9494-180892BB\n TerminateProcess@KERNEL32.dll at 7448-9732-1805A3F0","id":"stream-88","level":"suspicious","mitre_attack_id":"T1489","name":"Contains ability to terminate a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005884)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found MoveFileExW in import section (Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin)","id":"static-205","level":"informative","mitre_attack_id":"T1083","name":"Contains references to file movement (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$2c","id":"string-546","level":"informative","mitre_attack_id":"T1018","name":"Contains ability to retrieve remote session information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"$2d","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found string \"EXPLORER.EXE\" (Indicator: \"explorer.exe\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"%s\\explorer.exe \"microsoft-edge:%s\"\" (Indicator: \"explorer.exe\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")","id":"string-481","level":"informative","mitre_attack_id":"T1055","name":"Reference explorer.exe process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"msedgeupdate_unsigned.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"OpenThread@KERNEL32.dll at 7448-9190-1804545C\n OpenThread@KERNEL32.dll at 7448-9530-18045398","id":"stream-129","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to modify processes thread functionality","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2e","id":"string-184","level":"suspicious","mitre_attack_id":"T1547","name":"Found registry location strings which can modify auto-execute functionality","origin":"File/Memory","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"rundll32.exe\" queried SystemProcessInformation at 00000000-00005884-00000C15-2099961897 [PID: 5884]\n \"rundll32.exe\" queried SystemProcessInformation at 00000000-00005884-00000C15-2099969574 [PID: 5884]\n \"rundll32.exe\" queried SystemProcessInformation at 00000000-00005884-00000C15-2100174641 [PID: 5884]\n \"rundll32.exe\" queried SystemProcessInformation at 00000000-00005884-00000C15-2100183927 [PID: 5884]","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2f","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"$30","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$31","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$32","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 3C:92:02:BA:FA:CB:F9:B5:E3:F1:F1:AC:73:2C:6B:F4:F9:8B:4F:27; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: F2:52:E7:94:FE:43:8E:35:AC:E6:E5:37:62:C0:A2:34:A2:C5:21:35; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"CreateDesktopShortcut\" (Indicator: \"CreateDesktop\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CreateDesktopShortcut\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-541","level":"informative","name":"Contains ability to create/switch the desktop (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"External Systems","description":"18/26 Antivirus vendors marked sample as malicious (69% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"$33","id":"string-323","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows HTTP services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-437","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to retrieve token privileges information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005884.00000001.200933.03600000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005884.00000001.200933.03600000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-920","level":"informative","mitre_attack_id":"T1486","name":"Able to access crypto-related API (String)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$34","id":"string-663","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment using user register activity","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin]","id":"static-88","level":"informative","mitre_attack_id":"T1059.003","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"External Systems","description":"18/26 Antivirus vendors marked sample as malicious (69% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$35","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-736","level":"informative","mitre_attack_id":"T1016","name":"Able to determine NetBIOS or DNS name associated with the local computer","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-417","level":"informative","mitre_attack_id":"T1018","name":"Able to identify remote systems","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"FindResourceW@KERNEL32.dll at 7448-6419-1811EE7C\n FindResourceW@KERNEL32.dll at 7448-6421-18118DD2\n FindResourceW@KERNEL32.dll at 7448-6512-18116E90","id":"stream-32","level":"suspicious","mitre_attack_id":"T1005","name":"Contains ability to find and load resources of a specific module","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"RegSetKeySecurity\" (Indicator: \"RegSetKeySecurity\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"QueryServiceConfig2W\" (File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"QueryServiceConfigW\" (File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"QueryServiceStatus\" (File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"QueryServiceConfig2W\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-910","level":"informative","mitre_attack_id":"T1007","name":"Able to query service configuration on system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")","id":"string-436","level":"informative","mitre_attack_id":"T1021.001","name":"Contains ability to perform remote desktop activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CredEnumerateW\" (Indicator: \"CredEnumerate\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CredEnumerateW\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-81","level":"informative","mitre_attack_id":"T1555.004","name":"Contains ability to to enumerates the credentials (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$37","id":"string-96","level":"informative","mitre_attack_id":"T1012","name":"Found registry key string for installed applications","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$38","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 5884 -ip 5884\" (UID: 00000000-00005220)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5884 -s 660\" (UID: 00000000-00006856)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5884 -s 660\" (UID: 00000000-00006092)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 5884 -s 660\" (UID: 00000000-00005392)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$39","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005884.00000000.200784.03910000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00005884.00000000.200784.03910000.00000002.mdmp","id":"string-4","level":"suspicious","mitre_attack_id":"T1055.011","name":"Found a string that may be used as part of an injection method","origin":"File/Memory","relevance":4,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-199","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"$3a","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"https://config.edge.skype.com/config/v1/EdgeUpdate\" (Indicator: \"skype.com\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n \"https://config.edge.skype.com/config/v1/EdgeUpdate\" (Indicator: \"skype.com\")","id":"string-61","level":"suspicious","name":"Found an instant messenger related domain","origin":"File/Memory","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetDriveTypeW@KERNEL32.dll at 7448-7417-1808BC96","id":"stream-66","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerates all mounted drives","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found registry modification API: \"RegCreateKeyTransactedW\" in file \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\"","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Able to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"$3b","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin]","id":"static-192","level":"informative","mitre_attack_id":"T1083","name":"Able to retrieve the valid logical drives on the computer","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-478","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve process ID (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3c","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$3d","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$3e","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 7448-9496-18089210\n K32EnumProcesses@KERNEL32.dll at 7448-10220-180D4CD0","id":"stream-20","level":"suspicious","mitre_attack_id":"T1057","name":"Contains ability to enumerate processes/modules/threads","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" claimed CRC 2392075 while the actual is CRC 2425607","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTickCount64@KERNEL32.dll at 7448-7453-180D2C20\n GetTickCount64@KERNEL32.dll at 7448-8252-1807D6D9\n GetTickCount@KERNEL32.dll at 7448-8746-18017A10\n GetTickCount@KERNEL32.dll at 7448-9462-18015A70","id":"stream-87","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment (API)","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 1056529)","id":"binary-30","level":"informative","mitre_attack_id":"T1027.007","name":"Able to read the PEB (Process Environment Block) structure","origin":"Binary File","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"rundll32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005884)\n \"rundll32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005884)\n \"rundll32.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005884)\n \"rundll32.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005884)","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"$3f","id":"string-538","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a HTTP or FTP session (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-730","level":"informative","mitre_attack_id":"T1083","name":"Able to determine the valid logical drives on the computer","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$40","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$41","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 773C0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"238\" [Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin]","id":"static-145","level":"informative","mitre_attack_id":"T1106","name":"PE file contains large number of import functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".text\" is \"0x16870a\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-239","level":"informative","mitre_attack_id":"T1548.002","name":"Contains ability to bypass UAC using COM object (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"IsDebuggerPresent@KERNEL32.dll at 7448-6244-18126543\n OutputDebugStringW@KERNEL32.dll at 7448-9336-18009C40\n OutputDebugStringW@KERNEL32.dll at 7448-9423-18007DD8\n OutputDebugStringW@KERNEL32.dll at 7448-9429-18009683\n OutputDebugStringW@KERNEL32.dll at 7448-9430-18009803\n OutputDebugStringW@KERNEL32.dll at 7448-9435-18009BEE\n OutputDebugStringW@KERNEL32.dll at 7448-9436-180094E9\n IsDebuggerPresent@KERNEL32.dll at 7448-10690-181258FF","id":"stream-75","level":"suspicious","mitre_attack_id":"T1622","name":"Able to check if a debugger is running","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" has section name .rsrc with entropy \"7.142743720291702\"","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"Section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"$42","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$43","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"rundll32.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005884)","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found 25 calls to GetProcAddress@KERNEL32.dll at 7448-8242-180832FF","id":"stream-40","level":"suspicious","mitre_attack_id":"T1027.007","name":"Looks up multiple procedures within the same disassembly stream (often used to hide usage)","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$44","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\MicrosoftCrashServices","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".text\" is \"0x168800\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-10073","level":"informative","mitre_attack_id":"T1489","name":"Able to change the configuration parameters of a service","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Error: The operation completed successfully. (0x0)","id":"certificate-1","level":"malicious","mitre_attack_id":"T1553.002","name":"The input sample is signed with an invalid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-242","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to close a handle to a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"[File::OpenShareMode - CreateFile failed][%s][%d][%d][0x%x]\" (Indicator: \"CreateFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"penShareMode - CreateFile failed][%s][%d][%d][0x%x]\" (Indicator: \"CreateFile\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"[File::OpenShareMode - CreateFile failed][%s][%d][%d][0x%x]\" (Indicator: \"CreateFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" has an writable section named \".data\"\n \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" has an writable section named \".didat\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" file has an entrypoint instructions - \"jmp\t0x18102afa,or\tal, 1,jne\t0x1812626e,call\t0x181268e2,push\tdword ptr [ebp + 0x10],push\tdword ptr [ebp + 0xc],push\tdword ptr [ebp + 8],call\t0x1812612a,add\tesp, 0xc,pop\tebp,ret\t0xc,jmp\t0x181259d3,push\tebp,mov\tebp, esp,jmp\t0x1812629a,push\tdword ptr [ebp + 8],call\t0x1814ba27,pop\tecx,test\teax, eax,je\t0x181262a9,push\tdword ptr [ebp + 8],call\t0x18142938,pop\tecx,test\teax, eax,je\t0x1812628d,pop\tebp,ret\t,cmp\tdword ptr [ebp + 8], -1,je\t0x18126ada,jmp\t0x18126abd,push\tebp,mov\tebp, esp,pop\tebp,jmp\t0x18126288,push\tebp,mov\tebp, esp,\"","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$46","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string \"DeleteService\" (File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"DeleteService\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-690","level":"informative","mitre_attack_id":"T1543.003","name":"Able to unregister service from Service Control Manager","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$47","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindFirstFileExW@KERNEL32.dll at 7448-6275-18155317\n FindFirstFileW@KERNEL32.dll at 7448-8120-1800CC92\n FindFirstFileW@KERNEL32.dll at 7448-9744-1806D960\n FindFirstFileW@KERNEL32.dll at 7448-9801-1806E642","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"Process \"rundll32.exe\" (UID: 00000000-00005884) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00005884) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$48","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Able to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$49","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4a","id":"string-901","level":"informative","mitre_attack_id":"T1124","name":"Able to retrieve date formats supported by the local system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"[Copilot][Home SKU during OOBE][Skipping --copilot-upgrade-only to allow direct install]\" (Indicator: \"ping -\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found string \"[Copilot][Home SKU during OOBE][Skipping --copilot-upgrade-only to allow direct install]\" (Indicator: \"ping -\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-5070","level":"informative","mitre_attack_id":"T1016.001","name":"Able to check internet connectivity using ping command","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-84","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to find logical drives of the machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4b","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4c","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetModuleFileNameW@KERNEL32.dll at 7448-6288-1815563C\n GetModuleFileNameW@KERNEL32.dll at 7448-6503-18046A89\n K32GetModuleFileNameExW@KERNEL32.dll at 7448-9467-18018435","id":"stream-131","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$4d","id":"string-338","level":"informative","mitre_attack_id":"T1132","name":"Contains ability to perform Base64 encoding/decoding","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp, 00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 5884)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\74E50E20C15B4D09920ABA894C24DCBB92E491EF659EEB0A30E5F899894EA59C.BIN.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\74E50E20C15B4D09920ABA894C24DCBB92E491EF659EEB0A30E5F899894EA59C.BIN.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\74E50E20C15B4D09920ABA894C24DCBB92E491EF659EEB0A30E5F899894EA59C.BIN.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\74E50E20C15B4D09920ABA894C24DCBB92E491EF659EEB0A30E5F899894EA59C.BIN.DLL.2.MANIFEST\"","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin]","id":"static-191","level":"informative","mitre_attack_id":"T1489","name":"Calls an API used to open a process handle","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-223","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to free the memory used by network management functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"WerFault.exe\" [UID: 00000000-00005220]\n Process \"WerFault.exe\" [UID: 00000000-00006856]\n Process \"WerFault.exe\" [UID: 00000000-00006092]\n Process \"WerFault.exe\" [UID: 00000000-00005392]","id":"target-585","level":"informative","mitre_attack_id":"T1564","name":"Spawns Windows crash diagnostic and reporting process","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 7448-9735-1806E8A3\n GetSystemTimeAsFileTime@KERNEL32.dll at 7448-10353-181003E0\n GetSystemTimeAsFileTime@KERNEL32.dll at 7448-10470-18126895","id":"stream-2","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"Shutdown event set]\" (Indicator: \"shutdown \") in Source: 74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$4e","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4f","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Able to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FileTimeToLocalFileTime@KERNEL32.dll at 7448-9097-1804B321\n GetSystemTimeAsFileTime@KERNEL32.dll at 7448-9735-1806E8A3\n GetSystemTimeAsFileTime@KERNEL32.dll at 7448-10353-181003E0\n GetSystemTimeAsFileTime@KERNEL32.dll at 7448-10470-18126895","id":"stream-71","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to query local/system time as file time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"\"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$50","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"External Systems","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","id":"avtest-5","level":"malicious","mitre_attack_id":"T1204.002","name":"Sample was identified as malicious by a trusted antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005884.00000001.200933.010E9000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin\")","id":"string-195","level":"informative","mitre_attack_id":"T1027","name":"Contains key cryptographic functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"LastOSVersion\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"LastOSVersionPatchNumber\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00005884.00000000.200784.72BDA000.00000002.mdmp\")","id":"string-937","level":"informative","mitre_attack_id":"T1082","name":"Able to gather system information (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]},{"category":"General","description":"$51","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"69c096c233989cdd2a0edf68","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":18,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":74},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":197,"malicious_count":4,"suspicious_count":16,"total":217}},"summary":{"score":100,"tags":["pioneer"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c.bin","file_size":2407975,"file_type":["pedll","executable"],"file_type_id":"dll"},"hashes":{"imphash":"f488c196831b4696983c5a865aea58c5","md5":"2c020f40cae7c4426a5a7c921c0fc8d7","sha1":"908eb7d17edb703e318d974a254b467cd17bd0d7","sha256":"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c","sha512":"81a1e38207d5c4ee32c0fd0fbd60a78d165c7e02921cf0d706cc31792f25ae3ae015e27a527ae631f154d7f4be8942c675e82e8059336d034b43c07e80de3e61","ssdeep":"49152:W1O2/l6TOXUVPOg3hmGS79fhmjj5ho1bJys4aNFpE:W4oITOXUVxmMhoVJyeFa","ssdeep_chunks":["49152:W1O2/l6","49152:1O2/l6T","49152:O2/l6TO","49152:2/l6TOX","49152:/l6TOXU","49152:l6TOXUV","49152:6TOXUVP","49152:TOXUVPO","49152:OXUVPOg","49152:XUVPOg3","49152:UVPOg3h","49152:VPOg3hm","49152:POg3hmG","49152:Og3hmGS","49152:g3hmGS7","49152:3hmGS79","49152:hmGS79f","49152:mGS79fh","49152:GS79fhm","49152:S79fhmj","49152:79fhmjj","49152:9fhmjj5","49152:fhmjj5h","49152:hmjj5ho","49152:mjj5ho1","49152:jj5ho1b","49152:j5ho1bJ","49152:5ho1bJy","49152:ho1bJys","49152:o1bJys4","49152:1bJys4a","49152:bJys4aN","49152:Jys4aNF","49152:ys4aNFp","49152:s4aNFpE","98304:W1O2/l6","98304:1O2/l6T","98304:O2/l6TO","98304:2/l6TOX","98304:/l6TOXU","98304:l6TOXUV","98304:6TOXUVP","98304:TOXUVPO","98304:OXUVPOg","98304:XUVPOg3","98304:UVPOg3h","98304:VPOg3hm","98304:POg3hmG","98304:Og3hmGS","98304:g3hmGS7","98304:3hmGS79","98304:hmGS79f","98304:mGS79fh","98304:GS79fhm","98304:S79fhmj","98304:79fhmjj","98304:9fhmjj5","98304:fhmjj5h","98304:hmjj5ho","98304:mjj5ho1","98304:jj5ho1b","98304:j5ho1bJ","98304:5ho1bJy","98304:ho1bJys","98304:o1bJys4","98304:1bJys4a","98304:bJys4aN","98304:Jys4aNF","98304:ys4aNFp","98304:s4aNFpE","49152:W4oITOX","49152:4oITOXU","49152:oITOXUV","49152:ITOXUVx","49152:TOXUVxm","49152:OXUVxmM","49152:XUVxmMh","49152:UVxmMho","49152:VxmMhoV","49152:xmMhoVJ","49152:mMhoVJy","49152:MhoVJye","49152:hoVJyeF","49152:oVJyeFa"]},"submissions":{"first_seen":1774229124000,"last_multi_scan":1774229187000,"last_seen":1774229187000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["69c096c233989cdd2a0edf68"]},"schema_version":"1.0.9","sha256":"74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c","threat_score":100,"unified_at":"2026-09-06T15:36:28.526Z","unified_at_epoch_ms":1788708988526,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Virus.Floxif Sample 74e50e20c15b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 74e50e20c15b…. Malware family: Virus.Floxif. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c"}],["$","meta","4",{"property":"og:title","content":"Malicious Virus.Floxif Sample 74e50e20c15b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 74e50e20c15b…. Malware family: Virus.Floxif. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Virus.Floxif Sample 74e50e20c15b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 74e50e20c15b…. Malware family: Virus.Floxif. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L52","11",{}]]