34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 73:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T43f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 79bfa4539edc… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 79bfa4539edc…. Threat score 70/100. 0/26 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705"],"about":{"@type":"SoftwareApplication","name":"Windows-KB890830-x64-V5.147.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","additionalType":"Suspicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T454,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "sample.bin"), Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin")37:T2795,Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "FDIDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "FDICreate"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualLock"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "EventRegister"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "NtSetInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "FDICopy"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "EventUnregister"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")38:T1e33,Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; File: "windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe") Found reference to API "CreateToolhelp32SnapshotWriteProcessMemoryloadresource" (Indicator: "WriteProcessMemory"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found reference to API "getwindowthreadprocessidlookupprivilegevalueaCreateRemoteThreadopenprocesstokenCreateThreadfindwindowaopenprocessKillTimersettimer=%s&r=%s&l=%s&m=%s&r=%s&l=%d&m" (Indicator: "CreateThread"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000000.127913.9C80C000.00000002.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.26D20000.00000002.mdmp, 00000000-00003660.00000001.129833.26D60000.00000002.mdmp, 00000000-00003660.00000001.129833.26E20000.00000002.mdmp, 00000000-00003660.00000001.129833.28E30000.00000002.mdmp, 00000000-00003660.00000001.129833.2C8A0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D330000.00000002.mdmp, 00000000-00003660.00000001.129833.2D830000.00000002.mdmp, 00000000-00003660.00000001.129833.2D870000.00000002.mdmp, 00000000-00003660.00000001.129833.2DA90000.00000002.mdmp, 00000000-00003660.00000001.129833.2DDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E980000.00000002.mdmp, 00000000-00003660.00000001.129833.2EB00000.00000002.mdmp, 00000000-00003660.00000001.129833.2EC60000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2EF30000.00000002.mdmp, 00000000-00003660.00000001.129833.2F0B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F140000.00000002.mdmp, 00000000-00003660.00000001.129833.2F760000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30290000.00000002.mdmp, 00000000-00003660.00000001.129833.30330000.00000002.mdmp, 00000000-00003660.00000001.129833.30390000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp, 00000000-00003660.00000001.129833.305A0000.00000002.mdmp, 00000000-00003660.00000001.129833.32110000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp, 00000000-00003660.00000001.129833.261C1000.00000004.mdmp, 00000000-00003660.00000001.129833.28CA0000.00000002.mdmp, 00000000-00003660.00000001.129833.29910000.00000002.mdmp, 00000000-00003660.00000001.129833.2C690000.00000002.mdmp, 00000000-00003660.00000001.129833.2D410000.00000002.mdmp, 00000000-00003660.00000001.129833.2D430000.00000002.mdmp, 00000000-00003660.00000001.129833.2D870000.00000002.mdmp, 00000000-00003660.00000001.129833.2D9F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DA90000.00000002.mdmp, 00000000-00003660.00000001.129833.2DDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DE40000.00000002.mdmp, 00000000-00003660.00000001.129833.2DE70000.00000002.mdmp, 00000000-00003660.00000001.129833.2E980000.00000002.mdmp, 00000000-00003660.00000001.129833.2EB00000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F0B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F140000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.303B0000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp, 00000000-00003660.00000001.129833.261C1000.00000004.mdmp, 00000000-00003660.00000001.129833.263B0000.00000002.mdmp, 00000000-00003660.00000001.129833.26D60000.00000002.mdmp, 00000000-00003660.00000001.129833.26D90000.00000002.mdmp, 00000000-00003660.00000001.129833.26E00000.00000002.mdmp, 00000000-00003660.00000001.129833.28B30000.00000002.mdmp, 00000000-00003660.00000001.129833.28CA0000.00000002.mdmp, 00000000-00003660.00000001.129833.29910000.00000002.mdmp, 00000000-00003660.00000001.129833.2C690000.00000002.mdmp, 00000000-00003660.00000001.129833.2C790000.00000002.mdmp, 00000000-00003660.00000001.129833.2CF40000.00000002.mdmp, 00000000-00003660.00000001.129833.2CFE0000.00000002.mdmp, 00000000-00003660.00000001.129833.2CFF0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D000000.00000002.mdmp, 00000000-00003660.00000001.129833.2D020000.00000002.mdmp, 00000000-00003660.00000001.129833.2D050000.00000002.mdmp, 00000000-00003660.00000001.129833.2D0A0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D210000.00000002.mdmp, 00000000-00003660.00000001.129833.2D410000.00000002.mdmp, 00000000-00003660.00000001.129833.2D430000.00000002.mdmp, 00000000-00003660.00000001.129833.2D5D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D870000.00000002.mdmp, 00000000-00003660.00000001.129833.2D8D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D950000.00000002.mdmp, 00000000-00003660.00000001.129833.2D970000.00000002.mdmp, 00000000-00003660.00000001.129833.2D990000.00000002.mdmp, 00000000-00003660.00000001.129833.2D9B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D9D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D9F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DA20000.00000002.mdmp, 00000000-00003660.00000001.129833.2DA90000.00000002.mdmp, 00000000-00003660.00000001.129833.2DAB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DAD0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DE40000.00000002.mdmp, 00000000-00003660.00000001.129833.2DE70000.00000002.mdmp, 00000000-00003660.00000001.129833.2DFA0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DFD0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E090000.00000002.mdmp, 00000000-00003660.00000001.129833.2E0C0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E0F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E560000.00000002.mdmp, 00000000-00003660.00000001.129833.2E870000.00000002.mdmp, 00000000-00003660.00000001.129833.2E980000.00000002.mdmp, 00000000-00003660.00000001.129833.2EB00000.00000002.mdmp, 00000000-00003660.00000001.129833.2EC00000.00000002.mdmp, 00000000-00003660.00000001.129833.2ECD0000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2EEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.2EF30000.00000002.mdmp, 00000000-00003660.00000001.129833.2F030000.00000002.mdmp, 00000000-00003660.00000001.129833.2F0B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F140000.00000002.mdmp, 00000000-00003660.00000001.129833.2F520000.00000002.mdmp, 00000000-00003660.00000001.129833.2F760000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30290000.00000002.mdmp, 00000000-00003660.00000001.129833.30390000.00000002.mdmp, 00000000-00003660.00000001.129833.303B0000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp, 00000000-00003660.00000001.129833.30470000.00000002.mdmp, 00000000-00003660.00000001.129833.305A0000.00000002.mdmp, 00000000-00003660.00000001.129833.32110000.00000002.mdmp")39:T4c7,Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003660-00000CC3-703669404") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000000.127913.1F7C0000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1F7C0000.00000004.mdmp") Found reference to "Aesqh" (Indicator: "Aes"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003660.00000000.127913.1F7C0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F7C0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003660.00000000.127913.1F7C0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F7C0000.00000004.mdmp") Found reference to "ECDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003660.00000000.127913.1F9C0000.00000004.mdmp") Found reference to "Oid-Z" (Indicator: "Oid"; Source: "00000000-00003660.00000000.127913.21360000.00000004.mdmp, 00000000-00003660.00000001.129833.21360000.00000004.mdmp")3a:T8fa,Found PE header "MZ" - Source: "00000000-00003660.00000000.127913.273B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.24DB6000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.25DDF000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.261C1000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.26290000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.26480000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.26D10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.26D60000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.27340000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.27500000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28413000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.2854E000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28AC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28AF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28B00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28B20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28B30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28B40000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28B70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28B80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28B90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28BA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28BC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28BE0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003660.00000001.129833.28C10000.00000002.mdmp")3b:T826,"MRT.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "MRT.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "MRT.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "MRT.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "MRT.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "MRT.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")3c:T9a6,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-674324607 [PID: 2768] "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-674331037 [PID: 2768] "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-674511971 [PID: 2768] "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-674519196 [PID: 2768] "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-674676459 [PID: 2768] "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-674683461 [PID: 2768] "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-676324284 [PID: 2768] "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" queried SystemProcessInformation at 00000000-00002768-00000C15-676333756 [PID: 2768] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-701979035 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-701996988 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-702155545 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-702162958 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-702443780 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-702451982 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-702633456 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-702640839 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-703382060 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-703389854 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-709448099 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-709455321 [PID: 3660] "MRT.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-721717369 [PID: 3660]3d:T4ec,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Found encryption keys in memory dumps Matched sigs: Found Base64 encoding crypto library string in memory Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match – find crypto wallet file using regex pattern Matched sigs: YARA signature match - PowerShell with Base64 encoding Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - Base64-encoded PE executable within PE executable Matched sigs: YARA signature match - Encryption keys used by malware3e:T6886,Found XOR loop in file "MRT.exe" at offset 766920; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 774720; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 1720324; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 2853325; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 3425732; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 3426008; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 3897824; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 4396712; code bytes = 30d0 Found XOR loop in file "MRT.exe" at offset 14681; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 14811; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 14950; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 15044; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 15182; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 15291; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 44745; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 337673; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 337706; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 423891; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 479624; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 507754; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 507818; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1112114; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1256522; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1259924; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1260225; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1308692; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1324497; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1354033; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1531484; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1531491; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1532047; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1532054; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1532799; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1532806; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1533510; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1533517; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1534034; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1534041; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1536344; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1536351; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1536969; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1536976; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1537340; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1537347; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1537577; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1537584; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1541620; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1541627; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1546202; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1546209; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1547190; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1547201; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1547208; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1548549; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1584857; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1584864; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1585830; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1585837; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1586547; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1586554; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1587387; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1587394; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1693962; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1694055; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1714441; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 1982663; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2344159; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2344166; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2344529; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2344536; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2345256; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2345263; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2345919; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2345926; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2570150; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2570163; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2570176; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2754503; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2755626; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2755891; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2884169; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2884179; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 2984751; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3099810; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3324059; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3344866; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3465435; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3797230; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3798040; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3836669; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3836684; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 3873014; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4250203; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4250825; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4270198; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4420191; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4420271; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4420299; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4420332; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4420360; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4537205; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4577586; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4579593; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4579600; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4581616; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4701868; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4701879; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4701886; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4702093; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4702799; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4702810; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4702817; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4704484; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4706144; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4706151; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 4758706; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 5036548; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 5092052; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 5092057; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 5159677; code bytes = 33c1 Found XOR loop in file "MRT.exe" at offset 950969; code bytes = 30040e Found XOR loop in file "MRT.exe" at offset 75130; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 573280; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 595128; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 794816; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 797928; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 798272; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 907180; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 1484203; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 1672881; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 1914604; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 1949808; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 1959575; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2042669; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2042779; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2043489; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2053599; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2054030; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2073140; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2075209; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2215376; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2216277; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2216557; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2219403; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2336508; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2636016; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2740849; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2851815; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2853265; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2857219; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2857513; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 2992140; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3258684; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3258719; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3260605; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3260640; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3631312; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3687468; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3708955; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3716297; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3716847; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3717479; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3721984; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 3908074; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 4335841; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 4345615; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 4427963; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 4427997; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 4471907; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 4770749; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 5018026; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 5033586; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 5110221; code bytes = 8030 Found XOR loop in file "MRT.exe" at offset 5217671; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 755480; code bytes = 30d0 Found XOR loop in file "MPENGINE.DLL" at offset 1888481; code bytes = 30d0 Found XOR loop in file "MPENGINE.DLL" at offset 2460888; code bytes = 30d0 Found XOR loop in file "MPENGINE.DLL" at offset 2461164; code bytes = 30d0 Found XOR loop in file "MPENGINE.DLL" at offset 2932980; code bytes = 30d0 Found XOR loop in file "MPENGINE.DLL" at offset 3431868; code bytes = 30d0 Found XOR loop in file "MPENGINE.DLL" at offset 5083347; code bytes = 30d0 Found XOR loop in file "MPENGINE.DLL" at offset 147270; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 291678; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 295080; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 295381; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 343848; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 359653; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 389189; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 566640; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 566647; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 567203; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 567210; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 567955; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 567962; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 568666; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 568673; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 569190; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 569197; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 571500; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 571507; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 572125; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 572132; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 572496; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 572503; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 572733; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 572740; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 576776; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 576783; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 581358; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 581365; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 582346; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 582357; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 582364; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 583705; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 620013; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 620020; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 620986; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 620993; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 621703; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 621710; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 622543; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 622550; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 729118; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 729211; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 749597; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1017819; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1379315; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1379322; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1379685; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1379692; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1380412; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1380419; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1381075; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1381082; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1605306; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1605319; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1605332; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1789659; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1790782; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1791047; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1919325; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 1919335; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2019907; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2134966; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2359215; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2380022; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2500591; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2832386; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2833196; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2871825; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2871840; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 2908170; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3285359; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3285981; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3305354; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3455347; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3455427; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3455455; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3455488; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3455516; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3572361; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3612742; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3614749; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3614756; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3616772; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3737024; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3737035; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3737042; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3737249; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3737955; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3737966; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3737973; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3739640; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3741300; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3741307; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 3793862; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4071704; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4127208; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4127213; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4194833; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4319724; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4319735; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4319742; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4320471; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4320476; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4345859; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4480111; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4480129; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4674560; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4681806; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4884826; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4963348; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4968876; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4968883; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4968945; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4968953; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 4969082; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 5084236; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 5190282; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 5190306; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 5190335; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 5190364; code bytes = 33c1 Found XOR loop in file "MPENGINE.DLL" at offset 519359; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 708037; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 949760; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 984964; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 994731; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1077825; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1077935; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1078645; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1088755; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1089186; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1108296; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1110365; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1250532; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1251433; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1251713; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1254559; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1371664; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1671172; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1776005; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1886971; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1888421; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1892375; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 1892669; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2027296; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2293840; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2293875; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2295761; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2295796; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2666468; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2722624; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2744111; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2751453; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2752003; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2752635; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2757140; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 2943230; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 3370997; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 3380771; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 3463119; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 3463153; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 3507063; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 3805905; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4053182; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4068742; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4145377; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4252827; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4333632; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4361550; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4707548; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4757906; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4761672; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 4968362; code bytes = 8030 Found XOR loop in file "MPENGINE.DLL" at offset 5019521; code bytes = 8030 Found XOR loop in file "MPGEAR.DLL" at offset 707766; code bytes = 30d0 Found XOR loop in file "MPGEAR.DLL" at offset 307839; code bytes = 33c1 Found XOR loop in file "MPGEAR.DLL" at offset 377430; code bytes = 33c1 Found XOR loop in file "MPGEAR.DLL" at offset 377449; code bytes = 33c1 Found XOR loop in file "MPGEAR.DLL" at offset 39336; code bytes = 8030 Found XOR loop in file "MPGEAR.DLL" at offset 608195; code bytes = 8030 Found XOR loop in file "MPGEAR.DLL" at offset 705394; code bytes = 8030 Found XOR loop in file "MPGEAR.DLL" at offset 710473; code bytes = 8030 Found XOR loop in file "MPGEAR.DLL" at offset 715710; code bytes = 8030 Found XOR loop in file "MPGEAR.DLL" at offset 720835; code bytes = 80303f:T55a,Found string "ttp://br.youtube.com/watch?v=rdo7zb8xiv0&feature=related" (Indicator: "youtube.com"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "hkey_current_user\software\microsoft\windows\currentversion\run\youtube.comf" (Indicator: "youtube.com"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "o se puede conectar. verifique el nombre de usuariohttp://www.youtube.com/watch?v=bradescoprime.com.brsantander.com.brwww.bb.com.britaupersonnalite.com.brcef.gov.brinternetbanking.caixa.gov.britau.com.br" (Indicator: "youtube.com"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string "paypal.com.br" (Indicator: "paypal.com"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string "mtpauthenticatecaixa.com.breal.com.brwww.unibanco.com.brorkut.comhotmail.comyoutube.com/watcht" (Indicator: "youtube.com"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") file/memory contains long string with (Indicator: "btc.com"; Source: "00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp")40:T68b,Found reference to API "PostMessages" (Indicator: "postmessage"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "getwindowthreadprocessidlookupprivilegevalueaCreateRemoteThreadopenprocesstokenCreateThreadfindwindowaopenprocessKillTimersettimer=%s&r=%s&l=%s&m=%s&r=%s&l=%d&m" (Indicator: "findwindow"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "document.getelementbyid("sendmessage").click()gostei muito dessa foto..." (Indicator: "sendmessage"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found reference to API "http://by137w.bay137.mail.live.com/mail/hiplight.aspx?n=http://bl103w.blu103.mail.live.com/mail/inboxlight.aspx?n=http://by142w.bay142.mail.live.com/mail/inboxlight.aspx?n=http://by137w.bay137.mail.live.com/mail/inboxlight.aspx?.mail.live.com/mail/sendmessagelight.aspx?_ec=1&n=comerciodoouro@gmail.comola, nao deixe de olhar minha mensagememail a enviar" (Indicator: "sendmessage"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found reference to API "afcoreoctopus has been successfully spawned (pid: %d)shutdown request from service control handleraccepting connection from %adiskfloodflooding of %s has been completedpostmessagea" (Indicator: "postmessage"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp")41:T41a,"MRT.exe" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00003660) "MRT.exe" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00003660) "MRT.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00003660) "MRT.exe" called "GetWindowTextW" with parameter "Please choose a type of scan:" - (UID: 00000000-00003660) "MRT.exe" called "GetWindowTextW" with parameter "&Quick scan. Scans areas of the system most likely to contain malicious software. If malicious software is found, you may be promp" - (UID: 00000000-00003660) "MRT.exe" called "GetWindowTextW" with parameter "&Full scan. Scans the entire system. Note that this scan can take up to several hours on some computers." - (UID: 00000000-00003660) "MRT.exe" called "GetWindowTextW" with parameter "&Customized scan. In addition to a quick scan, the tool will also scan the contents of a user-specified folder." - (UID: 00000000-00003660) "MRT.exe" called "GetWindowTextW" with parameter "Choose F&older ..." - (UID: 00000000-00003660)42:Tce8,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002768) "MRT.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003660) "MRT.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003660)43:T5d3,Found string "echo user_pref("network.proxy.type", 2); >>prefs.jswinmgmts:{impersonationlevel=impersonate}!\\.\root\securitycenterselect * from antivirusproduct===================" (Indicator: "select * from "; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "1o chave de seguran=robinwoodbr@gmail.comselect * from infectedsbradesco - atualiza" (Indicator: "select * from "; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "SELECT * FROM AntiVirusProductROOT\SecurityCenter2i" (Indicator: "select * from "; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string "inmgmts:\\localhost\root\cimv2SELECT * FROM Win32_OperatingSystemTFORM1" (Indicator: "select * from "; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "SELECT * FROM controle_dep_comunicacao WHERE N_MCADDRESS ='" (Indicator: "select * from "; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "EditNum099KeyPressImage24ClickSELECT * FROM netEditCod02KeyPressEditTab4_ItaKeyPress" (Indicator: "select * from "; Source: "00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp")44:T464,file/memory contains long string with (Indicator: "services\sharedaccess\parameters\firewallpolicy"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") file/memory contains long string with (Indicator: "services\sharedaccess\parameters\firewallpolicy"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "?usystem\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list" (Indicator: "services\sharedaccess\parameters\firewallpolicy"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string "netstat -anoSYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List127.0.0.1 www.login.vk.comDnsServer_11dns/send_p.php?sid=knock.php?ip=" (Indicator: "services\sharedaccess\parameters\firewallpolicy"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp")45:Tb3b,"MRT.exe" queries volume information of "C:\Windows\debug\mrt.log" at 00000000-00003660-00000C17-703055524 "MRT.exe" queries volume information of "C:\Windows\System32\winlogon.exe" at 00000000-00003660-00000C17-734762191 "MRT.exe" queries volume information of "C:\Windows\System32\fontdrvhost.exe" at 00000000-00003660-00000C17-734838750 "MRT.exe" queries volume information of "C:\Windows\System32\fontdrvhost.exe" at 00000000-00003660-00000C17-734909926 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-735200431 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-735549675 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-735609491 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-735922820 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-736041101 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-736154955 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-736224217 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-736371392 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-736496336 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-737097122 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-737180461 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-737401823 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-737469956 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-737589846 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-737700234 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-737891187 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-738347427 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-738611505 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-738743216 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-738863759 "MRT.exe" queries volume information of "C:\Windows\System32\svchost.exe" at 00000000-00003660-00000C17-73963602946:T4c5,"MRT.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "MRT.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")47:T10b8,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cabinet.dll (UID: 00000000-00002768) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\iphlpapi.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tdh.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\mpgear.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter \\?\%WINDIR%\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MPENGINE.DLL (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntdll.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wldp.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wofutil.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wintrust.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\powrprof.dll (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003660) "MRT.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003660)48:T4b63,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter FDICreate (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter FDICopy (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter FDIDestroy (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002768) "MRT.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter TdhGetEventInformation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter EnableTraceEx2 (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearCreateManager (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearSetEngine (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearSetEngineWithResourceSigs (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearCloseHandle (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearFreeData (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearGetManagerInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearRebootActions (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearDynamicConfigAddBool (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearDynamicConfigSend (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanOpen (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanSetOptionEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanQuick (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanFull (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanPath (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanControl (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanOpenThreatEnumerator (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanGetNextThreat (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanSetThreatAction (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanSetDefaultThreatActions (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanTakeActions (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanOpenActionResultsEnumerator (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanGetNextActionResult (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanGetStatistics (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearScanSubmitReportData (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearGetVirusNames (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearGetSigDataDWORD (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearSubmitHeartbeatReportData (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter MpGearGetMAPSURLs (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter InetNtopW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter InetPtonW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WSAAddressToStringW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter inet_ntop (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter inet_pton (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter ntohl (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter ntohs (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter rsignal (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter ClosePackageInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetFirmwareEnvironmentVariableA (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetFirmwareType (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetPackageInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetPackagePathByFullName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetPackagesByPackageFamily (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetProcessInformation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetProcessMitigationPolicy (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetStagedPackagePathByFullName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetThreadInformation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32EnumPageFilesW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32EnumProcessModules (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32EnumProcesses (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32GetMappedFileNameW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32GetModuleBaseNameW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32GetModuleFileNameExW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32GetModuleInformation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32GetProcessImageFileNameW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32GetProcessMemoryInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter K32QueryWorkingSetEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter OpenPackageInfoByFullName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter PackageFamilyNameFromFullName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter PackageIdFromFullName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter SetProcessInformation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter SetThreadInformation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WldpQueryWindowsLockdownMode (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WofSetFileDataLocation (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WofShouldCompressBinaries (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter NtGetCachedSigningLevel (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter NtSetCachedSigningLevel (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTimePrecise (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertAddEncodedCertificateToStore (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertDeleteCertificateFromStore (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertGetNameStringW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertNameToStrW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CertStrToNameW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptImportPublicKeyInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptMsgOpenToDecode (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptMsgUpdate (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptStringToBinaryW (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATAdminAcquireContext (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATAdminAcquireContext2 (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATAdminCalcHashFromFileHandle (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATAdminEnumCatalogFromHash (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATAdminReleaseCatalogContext (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATAdminReleaseContext (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATCatalogInfoFromContext (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATClose (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATGetAttrInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATGetMemberInfo (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CryptCATOpen (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter PowerSettingRegisterNotification (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter PowerSettingUnregisterNotification (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetSigFiles (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter FreeSigFiles (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter NtReadVirtualMemoryEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003660) "MRT.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003660)49:T548,Found reference to API "ShellExecute(urlopens" (Indicator: "ShellExecute"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000000.127913.262B0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp") Found reference to API "qShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F850000.00000002.mdmp, 00000000-00003660.00000001.129833.2F950000.00000002.mdmp, 00000000-00003660.00000001.129833.2FB60000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.301C0000.00000002.mdmp, 00000000-00003660.00000001.129833.30B90000.00000002.mdmp")4a:T92e,Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; File: "windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe") Found reference to API "getwindowthreadprocessidlookupprivilegevalueaCreateRemoteThreadopenprocesstokenCreateThreadfindwindowaopenprocessKillTimersettimer=%s&r=%s&l=%s&m=%s&r=%s&l=%d&m" (Indicator: "CreateThread"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000000.127913.9C80C000.00000002.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.26D20000.00000002.mdmp, 00000000-00003660.00000001.129833.26D60000.00000002.mdmp, 00000000-00003660.00000001.129833.26E20000.00000002.mdmp, 00000000-00003660.00000001.129833.28E30000.00000002.mdmp, 00000000-00003660.00000001.129833.2C8A0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D330000.00000002.mdmp, 00000000-00003660.00000001.129833.2D830000.00000002.mdmp, 00000000-00003660.00000001.129833.2D870000.00000002.mdmp, 00000000-00003660.00000001.129833.2DA90000.00000002.mdmp, 00000000-00003660.00000001.129833.2DDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E980000.00000002.mdmp, 00000000-00003660.00000001.129833.2EB00000.00000002.mdmp, 00000000-00003660.00000001.129833.2EC60000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2EF30000.00000002.mdmp, 00000000-00003660.00000001.129833.2F0B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F140000.00000002.mdmp, 00000000-00003660.00000001.129833.2F760000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30290000.00000002.mdmp, 00000000-00003660.00000001.129833.30330000.00000002.mdmp, 00000000-00003660.00000001.129833.30390000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp, 00000000-00003660.00000001.129833.305A0000.00000002.mdmp, 00000000-00003660.00000001.129833.32110000.00000002.mdmp")4b:T85b,"MPGEAR.DLL" contains export function called "MpGearCloseHandle" at ordinal 1 "MPGEAR.DLL" contains export function called "MpGearContainerAnalyze" at ordinal 2 "MPGEAR.DLL" contains export function called "MpGearContainerCloseObject" at ordinal 3 "MPGEAR.DLL" contains export function called "MpGearContainerCommit" at ordinal 4 "MPGEAR.DLL" contains export function called "MpGearContainerDelete" at ordinal 5 "MPGEAR.DLL" contains export function called "MpGearContainerFreeObjectInfo" at ordinal 6 "MPGEAR.DLL" contains export function called "MpGearContainerGetNext" at ordinal 7 "MPGEAR.DLL" contains export function called "MpGearContainerOpen" at ordinal 8 "MPGEAR.DLL" contains export function called "MpGearContainerOpenObject" at ordinal 9 "MPGEAR.DLL" contains export function called "MpGearContainerRead" at ordinal 10 "MPGEAR.DLL" contains export function called "MpGearContainerRecognize" at ordinal 11 "MPGEAR.DLL" contains export function called "MpGearContainerSetSize" at ordinal 12 "MPGEAR.DLL" contains export function called "MpGearContainerWrite" at ordinal 13 "MPGEAR.DLL" contains export function called "MpGearCreateManager" at ordinal 14 "MPGEAR.DLL" contains export function called "MpGearDuplicateHandle" at ordinal 15 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigAddBinary" at ordinal 16 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigAddBool" at ordinal 17 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigAddDWORD" at ordinal 18 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigAddQWORD" at ordinal 19 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigAddString" at ordinal 20 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigAddStringList" at ordinal 21 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigClear" at ordinal 22 "MPGEAR.DLL" contains export function called "MpGearDynamicConfigSend" at ordinal 23 "MPGEAR.DLL" contains export function called "MpGearFreeData" at ordinal 24 "MPGEAR.DLL" contains export function called "MpGearGetDllVersion" at ordinal 254c:T44d,Process kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2768:304:WilStaging_02" Process kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2768:304:WilStaging_02" Process kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe created mutex with name "SM0:2768:304:WilStaging_02" Process kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe created mutex with name "Local\SM0:2768:304:WilStaging_02" Process MRT.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3660:304:WilStaging_02" Process MRT.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3660:304:WilStaging_02" Process MRT.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3660:120:WilError_03" Process MRT.exe created mutex with name "SM0:3660:120:WilError_03" Process MRT.exe created mutex with name "Local\SM0:3660:304:WilStaging_02" Process MRT.exe created mutex with name "SM0:3660:304:WilStaging_02"4d:T41a,Pattern match: "ge@_.xw" Pattern match: "brontok@mm.gen" Pattern match: "wukill@mm.gen" Pattern match: "juniorsantos@gmail.comporravc" Pattern match: "listahotmailwecham@gmail.comc" Pattern match: "governo@brasil.gov.br" Pattern match: "novavibe01@gmail.com" Pattern match: "lida.ftp.webalice.itsdemaia@uol.com.brvoltagesk" Pattern match: "bradesconetempresa.com.brlogsrox@gmail.com" Pattern match: "juciara.antonia@isbt.com.br" Pattern match: "droprickhard13@gmail.com" Pattern match: "msoe@microsoft.com" Pattern match: "festadocolono1@isbt.com.brthalixinhainvia" Pattern match: "dlkownz8@gmail.como" Pattern match: "cartautentic321@gmail.comchegada" Pattern match: "vaivamoslah@gmail.comfrom" Pattern match: "systemdrivecarmelita.one@sapo.pt" Pattern match: "robinwoodbr@gmail.comselect" Pattern match: "brinfo2009@gmail.com.txt" Pattern match: "o@gordo.com.brantrax" Pattern match: "marisa@1giga.com.br" Pattern match: "wow@str.com.br" Pattern match: "personalite.h4x0r@hotmail.com" Pattern match: "fulano.2010.s@gmail.com"4e:T6cf,file/memory contains long string with (Indicator: "user-agent: "; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "Whttp://beruijindegunhadesun.com/ktmcheck.exeget /ktmcheck.exe http/1.1user-agent: mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)host: beruijindegunhadesun.com" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "Whttp://beruijindegunhadesun.com/ktmcheck.exeget /ktmcheck.exe http/1.1user-agent: mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)host: beruijindegunhadesun.com" (Indicator: "user-agent: "; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "http://%s/mozilla/4.0 (compatible; msie 6.0" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "dnsrecordlistfreeform/index.htmlmozilla/4.0 (compatible; msie 6.0)p" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") file/memory contains long string with (Indicator: "mozilla/4.0 ("; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "27. 77. .7. 8.1.\keys.ini\system32\drivers\Mozilla/5.0 (Windows" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp")4f:T1137,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffff0580000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8150a0000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8150a0000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff8150a0000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8150a0000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff80bb90000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff816810000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "%WINDIR%\SYSTEM32\CABINET.DLL" at base 7ff80c390000 "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" loaded module "NTDLL.DLL" at base 7ff817570000 "MRT.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffff0580000 "MRT.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8150a0000 "MRT.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8150a0000 "MRT.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff8150a0000 "MRT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8150a0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff80bb90000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTP.DLL" at base 7ff80e200000 "MRT.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ff816810000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\IPHLPAPI.DLL" at base 7ff813f90000 "MRT.exe" loaded module "RPCRT4.DLL" at base 7ff8165d0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\TDH.DLL" at base 7ff813580000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff816810000 "MRT.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff812a90000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff816b00000 "MRT.exe" loaded module "KERNEL32.DLL" at base 7ff816b00000 "MRT.exe" loaded module "WINTRUST.DLL" at base 7ff814de0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff815430000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff813bd0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8153a0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 7ff815070000 "MRT.exe" loaded module "CRYPT32.DLL" at base 7ff815430000 "MRT.exe" loaded module "KERNEL32" at base 7ff816b00000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MPGEAR.DLL" at base 7ff805040000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32.DLL" at base 7ff8168d0000 "MRT.exe" loaded module "\\?\%WINDIR%\SYSTEM32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MPENGINE.DLL" at base 7fffeb290000 "MRT.exe" loaded module "OLE32.DLL" at base 7ff816bd0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 7ff817570000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 7ff814550000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\WOFUTIL.DLL" at base 7ff805030000 "MRT.exe" loaded module "KERNELBASE.DLL" at base 7ff8150a0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff814de0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\POWRPROF.DLL" at base 7ff814ae0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8125a0000 "MRT.exe" loaded module "COMCTL32.DLL" at base 7ffffcaf0000 "MRT.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff816e10000 "MRT.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff816e10000 "MRT.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff816fc0000 "MRT.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff8163d0000 "MRT.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8150a0000 "MRT.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8150a0000 "MRT.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8150a000050:T7e0,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00002768-00000C2B-674857171] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002768-00000C2B-674882199] Observed system executable string:"%WINDIR%\system32\cabinet.dll" [Source: 00000000-00002768-00000C2B-674909075] Observed system executable string:"%WINDIR%\system32\winhttp.dll" [Source: 00000000-00003660-00000C2B-702415068] Observed system executable string:"%WINDIR%\system32\iphlpapi.dll" [Source: 00000000-00003660-00000C2B-702608085] Observed system executable string:"%WINDIR%\system32\tdh.dll" [Source: 00000000-00003660-00000C2B-702761921] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003660-00000C2B-702831064] Observed system executable string:"%WINDIR%\system32\bcrypt.dll" [Source: 00000000-00003660-00000C2B-703060695] Observed system executable string:"%WINDIR%\system32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\mpgear.dll" [Source: 00000000-00003660-00000C2B-703875035] Observed system executable string:"%WINDIR%\system32\ws2_32.dll" [Source: 00000000-00003660-00000C2B-704379065] Observed system executable string:"\\?\%WINDIR%\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MPENGINE.DLL" [Source: 00000000-00003660-00000C2B-704447123] Observed system executable string:"%WINDIR%\system32\ntdll.dll" [Source: 00000000-00003660-00000C2B-704551763] Observed system executable string:"%WINDIR%\system32\wldp.dll" [Source: 00000000-00003660-00000C2B-704605191] Observed system executable string:"%WINDIR%\system32\wofutil.dll" [Source: 00000000-00003660-00000C2B-704690310] Observed system executable string:"%WINDIR%\system32\crypt32.dll" [Source: 00000000-00003660-00000C2B-704801267] Observed system executable string:"%WINDIR%\system32\wintrust.dll" [Source: 00000000-00003660-00000C2B-704915878] Observed system executable string:"%WINDIR%\system32\powrprof.dll" [Source: 00000000-00003660-00000C2B-709423272]51:Ta08,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\MSASN1"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\APPMODEL\LOOKASIDE\PACKAGES"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "")52:T11da,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "DE5DCAEE-6F88-585A-05EE-D8B05B912772"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A99B2EB4-5620-44F5-9B02-F9D2EEBF2E96"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "")53:T56b,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "\Device\KsecDD" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\MSASN1.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\Windows\System32\msasn1.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSASN1.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\FLTLIB.DLL" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\MSVCP140.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSVCP140.dll" "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" trying to touch file "C:\VCRUNTIME140.dll"54:Ta97,"MRT.exe" trying to access non-existent file "C:\Windows\SystemResources\MRT.exe.mun" "MRT.exe" trying to access non-existent file "C:\Windows\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MRT\01356DCA-1A95-41FA-B75C-B980FF606B51\mpcache-E75F03A3B51D8BFE83F184D8B3AAC6A5584BA360.bin" "MRT.exe" trying to access non-existent file "C:\Windows\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MRT\01356DCA-1A95-41FA-B75C-B980FF606B51\MpEngineTestLicense.dat" "MRT.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\ntuser.dat" "MRT.exe" trying to access non-existent file "C:\Windows\System32\config\systemprofile\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\Windows\ServiceProfiles\LocalService\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\Windows\ServiceProfiles\NetworkService\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\Users\Classic .NET AppPool\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\Users\.NET v4.5\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\Users\.NET v2.0\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\Users\.NET v4.5 Classic\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\Users\.NET v2.0 Classic\AppData\Local\VirtualStore" "MRT.exe" trying to access non-existent file "C:\%NVM_SYMLINK%" "MRT.exe" trying to access non-existent file "C:\Windows\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MRT\01356DCA-1A95-41FA-B75C-B980FF606B51\MpPayloadData" "MRT.exe" trying to access non-existent file "C:\WINDOWS\system32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MRT\01356DCA-1A95-41FA-B75C-B980FF606B51\MpPayloadData" "MRT.exe" trying to access non-existent file "C:\Windows\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MRT\01356DCA-1A95-41FA-B75C-B980FF606B51\RebootActions" "MRT.exe" trying to access non-existent file "C:\WINDOWS\system32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MRT\01356DCA-1A95-41FA-B75C-B980FF606B51\RebootActions" "MRT.exe" trying to access non-existent file "C:\mde" "MRT.exe" trying to access non-existent file "C:\Windows\ccm" "MRT.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\root" "MRT.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft Office\root" "MRT.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft Office\office16" "MRT.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft Office\office15" "MRT.exe" trying to access non-existent file "C:\Program Files\Microsoft Office\office15"55:T44d,Found string "PING" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp") Found string "ping 0 & del "" (Indicator: "ping "; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp"), Found string "ping 0 -n" (Indicator: "ping "; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp"), Found string "ping 127.0.0.1 & del "" (Indicator: "ping "; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000000.127913.271F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp, 00000000-00003660.00000001.129833.26370000.00000002.mdmp, 00000000-00003660.00000001.129833.270F0000.00000002.mdmp, 00000000-00003660.00000001.129833.29480000.00000002.mdmp")56:T9ac,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003660-00000C2C-704402812") Found reference to API "HttpSendRequestAInternetReadFile\dvp.log\system32\drivers\etc\hostsVolk, ein REICH, ein Fuhrer !!!dvpd.DLL" (Indicator: "HttpSendRequest"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found reference to API "HttpSendRequestAInternetReadFile\dvp.log\system32\drivers\etc\hostsVolk, ein REICH, ein Fuhrer !!!dvpd.DLL" (Indicator: "InternetReadFile"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found reference to API "ReadProcessMemorySetWindowsHookExAInternetOpenUrlAforthgoergameclient.exesoul.exe" (Indicator: "InternetOpen"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000000.127913.26760000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.26760000.00000002.mdmp, 00000000-00003660.00000001.129833.2F270000.00000002.mdmp, 00000000-00003660.00000001.129833.2F850000.00000002.mdmp, 00000000-00003660.00000001.129833.2F950000.00000002.mdmp, 00000000-00003660.00000001.129833.30130000.00000002.mdmp") Found reference to API "terminateprocessGetUserObjectInformationAGetProcessWindowStationgetlastactivepopupHttpOpenRequestinternetcrackurla" (Indicator: "HttpOpenRequest"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "Services HotSenha possui tamanho invWindows Live Messengerhttp://mail.terra.com.brgoogle.com/accounts/ServiceLogin?service=mailWSASetServiceWWSARecvExTWebBrowserDocumentCompleteOnDownloadComplete" (Indicator: "WSARecv"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp, 00000000-00003660.00000001.129833.2F270000.00000002.mdmp, 00000000-00003660.00000001.129833.2F850000.00000002.mdmp, 00000000-00003660.00000001.129833.2F950000.00000002.mdmp, 00000000-00003660.00000001.129833.30130000.00000002.mdmp")57:Ta64,Found reference to API "HttpSendRequestAInternetReadFile\dvp.log\system32\drivers\etc\hostsVolk, ein REICH, ein Fuhrer !!!dvpd.DLL" (Indicator: "InternetReadFile"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found reference to API "Windows 2000InternetGetConnectedStateURLDownloadToFileA" (Indicator: "URLDownloadToFile"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found reference to API "Windows 2000InternetGetConnectedStateURLDownloadToFileA" (Indicator: "URLDownload"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found reference to API "URLDownloadToFileA" (Indicator: "URLDownloadToFile"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000000.127913.262E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1B0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.262D0000.00000002.mdmp, 00000000-00003660.00000001.129833.26380000.00000002.mdmp, 00000000-00003660.00000001.129833.2C9F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DAB0000.00000002.mdmp, 00000000-00003660.00000001.129833.30B90000.00000002.mdmp") Found reference to API "URLDownloadToFileA" (Indicator: "URLDownload"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000000.127913.262E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1B0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.262D0000.00000002.mdmp, 00000000-00003660.00000001.129833.26380000.00000002.mdmp, 00000000-00003660.00000001.129833.2C9F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DAB0000.00000002.mdmp, 00000000-00003660.00000001.129833.30B90000.00000002.mdmp") Found reference to API "URLDownloadT5" (Indicator: "URLDownload"; Source: "00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp") Found reference to API "pb\%windir%\FlashTopia\FlashMedia.exeweb:=@#("234FB2FF69CE584301D591DD5EE6413917730A4C15F2"),URLDownloadToFile, %web%/%" (Indicator: "URLDownloadToFile"; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp") Found reference to API "pb\%windir%\FlashTopia\FlashMedia.exeweb:=@#("234FB2FF69CE584301D591DD5EE6413917730A4C15F2"),URLDownloadToFile, %web%/%" (Indicator: "URLDownload"; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp")58:T9eb,Found string "$_2341234.tmp_exp.execgrb.exe((l|l)(o|o)(g|g)(i|i)(n|n)|(u|u)(s|s)(e|e)(r|r)|(n|n)(a|a)(m|m)(e|e))[a-za-z0-9_-]*=([a-za-z0-9_-]+)((p|p)(a|a)(s|s)(s|s)|(a|a)(u|u)(t|t)(h|h))[a-za-z0-9_-]*=([a-za-z0-9_-]+)_i%s%05d.exei%s%05d.dlli%s%05d.exeapplication: internet explorerif (top.location != self.location) top.location = self.location;document.login.pin.value="*****";target="bbtgt"content-disposition: form-data; name=datafile; filename="%s"formobj.elements.getattribute(temp1).value='';\hosts.sam_fuckallprocesses@8user-agent: msid [\..\tempsoftware\microsoft\windows nt\currentversion\winlogonibm%05d.dllibm%05d.exe/cib/login.jsp?*fiorg=cib.ibanking-services.com*vr-*ebanking.de/ebanking*action=startlogin/html/common/js/clientsniffer.js/html/german/loginpin.jsp\_expiorerbanking.raiffeisen.at/banking/loginpresentate.jspbankingportal.naspa.de/config/check_domain.php$_2341233.tmp\$a3e.tmpprogram files\common files\microsoft shared\web folders/c/jsenc/main.js_%s%05d.exeykb.teleweb.com.tr_expiorer.exe_expiorerexpiorer.dllstsvcmemstsvcmutmsarch_mutex_name\microsoft shared\web folders!<4(+6!6j!-((%j! size=%l" [Source: 00000000-00003660.00000000.127913.1D820000.00000004.mdmp] Observed email domain:"ube-167.pop.com.br/repositorio/77687/meusite201.22.164.181/mensagemsixyahbi.exe" [Source: 00000000-00003660.00000000.127913.1F140000.00000004.mdmp 00000000-00003660.00000001.129833.1F140000.00000002.mdmp] Observed email domain:"http://by137w.bay137.mail.live.com/mail/hiplight.aspx?n=http://bl103w.blu103.mail.live.com/mail/inboxlight.aspx?n=http://by142w.bay142.mail.live.com/mail/inboxlight.aspx?n=http://by137w.bay137.mail.live.com/mail/inboxlight.aspx?.mail.live.com/mail/sendmessagelight.aspx?_ec=1&n=comerciodoouro@gmail.comola, nao deixe de olhar minha mensagememail a enviar" [Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp] Observed email domain:"giza157smtp.terra.com.br" [Source: 00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp] Observed email domain:"psmtp.terra.com.br" [Source: 00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp] Observed email domain:"install_flash_player.exewww.nuceu.com.br/novosite/imagens/smtp.gif" [Source: 00000000-00003660.00000000.127913.1F200000.00000004.mdmp 00000000-00003660.00000001.129833.1F200000.00000002.mdmp] Observed email domain:"_tenyps__lmx." [Source: 00000000-00003660.00000000.127913.1F200000.00000004.mdmp 00000000-00003660.00000001.129833.1F200000.00000002.mdmp] Observed email domain:"yumidimap.dll" [Source: 00000000-00003660.00000000.127913.1F200000.00000004.mdmp 00000000-00003660.00000001.129833.1F200000.00000002.mdmp] Observed email domain:"lvmx.exe" [Source: 00000000-00003660.00000000.127913.1F330000.00000004.mdmp 00000000-00003660.00000001.129833.1F330000.00000002.mdmp] Observed email domain:"acapodre.dominiotemporario.comsmtp.strato.com" [Source: 00000000-00003660.00000000.127913.1F340000.00000004.mdmp 00000000-00003660.00000001.129833.1F340000.00000002.mdmp] Observed email domain:"\unzip.exe-p rwxplpaz#$56&x dreamx.ziplkproc.resources" [Source: 00000000-00003660.00000000.127913.1F350000.00000004.mdmp]5c:Te9b,"2.5.29.37" "2.5.29.35" "2.5.29.31" "2.5.29.19" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" "2.5.29.15" "2.5.29.17" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.1" "2.5.4.3" "2.5.29.10" Potential IP "72.29.80.113" found in string "ttp://72.29.80.113/~nossacai/f" Potential IP "81.177.26.20" found in string "t=Tffsrfivveuelub.dllhttp://213.174.141.11/xml?a=http://www." Potential IP "174.136.0.231" found in string "http://174.136.0.231/" Potential IP "184.82.65.108" found in string ":\windowsf\hotmail1_http://184.82.65.108/msn/upload.phpb" Potential IP "187.109.161.164" found in string "praquem=chaves.wab@gmail.comhttp://187.109.161.164/r3.phpCaptura Wab - by sysv @2012c:\Temp\wab.txt" Potential IP "189.36.137.82" found in string "http://189.36.137.82/imagens/noticias/visita/EN/MySql/endnnew/" Potential IP "200.98.162.126" found in string "200.98.162.126/geradados.php" Potential IP "127.0.0.1" found in string "dE%BOTID%%BOTNET%http://127.0.0.1:%u/%COMMANDSERVER%%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x.phpvalue_%s_%s:d" "2.5.29.16" Potential IP "51.75.142.21" found in string "http://51.75.142.21/" Potential IPs "88.165.140.233" "46.166.146.165" "94.23.144.228" found in string "88.165.140.233";OXY 46.166.146.165";PROXY 94.23.144.228";santa1 = "*\x73\x61\x6E\x74\x61\x6E\x64\x65\x72*";ban1 = "*\x62\x61\x6E\x65\x73\x65*";w.atas.fr/karenn/ip.phpkropus.amarox.ru/temp/ip.php\extractie\ieextract.exex", "111.111.111.111", Potential IP "168.61.87.179" found in string "http://168.61.87.179/appletmoduleactivate tovofritotoratora", Potential IP "127.0.0.1" found in string "ping 127.0.0.1 & del ""5d:T789,Found string "CONNECT %s:%i HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.26DD0000.00000002.mdmp") Found string "GET /btcheck.exe HTTP/1.1GET /winch32.exe HTTP/1.1http://try-anything-else.com/" (Indicator: "HTTP/1.1"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "ONnECT %s:%i HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "GET class%d.cgi?talkid=%dT:%d P:%s:%d H:%dCONNECT %s:%d HTTP/1.1GetFileSize1(%s) Error(%d)CreateFile(%s) Error(%d)" (Indicator: "HTTP/1.1"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "#DoOnECt %s:%i HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string ".jpg HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp, 00000000-00003660.00000000.127913.26280000.00000004.mdmp, 00000000-00003660.00000000.127913.26590000.00000004.mdmp, 00000000-00003660.00000001.129833.26280000.00000002.mdmp") Found string "[LINKEXE 1].mod HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp")5e:T660,Found string "HttpSendRequestAInternetReadFile\dvp.log\system32\drivers\etc\hostsVolk, ein REICH, ein Fuhrer !!!dvpd.DLL" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string ":\windows\system32\drivers\etc\hostsinternetbanking.caixa.gov.br # gbpluguinc:\borogvegas.txt" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "bpluginharddiskvolume1\windows\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "echo127.0.0.1viabcp.com>>%windir%\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00003660.00000000.127913.1FBC0000.00000004.mdmp") Found string "\??\c:\windows\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp") Found string "windows\system32\drivers\etc\hosts.com.br/cont/index.phptkilokoR" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp")5f:T489,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe") Found reference to API "enumservicesstatuswfindnextfilewNtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found reference to API "terminateprocessGetUserObjectInformationAGetProcessWindowStationgetlastactivepopupHttpOpenRequestinternetcrackurla" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "terminateprocessGetUserObjectInformationAGetProcessWindowStationgetlastactivepopupHttpOpenRequestinternetcrackurla" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found reference to API "98,2800,3217,,LookupAccountSidW,advapi32.dll,"00:33:16.890",RX=0,PX=0" (Indicator: "LookupAccountSid"; Source: "00000000-00003660.00000000.127913.1F9C0000.00000004.mdmp")60:T6b7,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter System" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00002768) "kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00002768)61:T9b1,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.265E0000.00000002.mdmp") Found string "Aesqh" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "\bob.txtineturl:/1.0easypagos.actualizaestadocash/post.asp" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "!Bancos.AES" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp") Found string "!Banload.AES" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp") Found string "Halert("Senha InvalidaFechar_OnClick\tudo\bhobankline.itau.com.brUPDATE AMARELONOVO SETlkMinhaSegurancaes sobre os seus investimentosrentabilidade de fundos" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp 00000000-00003660.00000001.129833.1F340000.00000002.mdmp"), Found string "!Banker.AES" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp 00000000-00003660.00000001.129833.1F340000.00000002.mdmp"), Found string "!Zbot.AES" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp 00000000-00003660.00000001.129833.1F340000.00000002.mdmp"), Found string "bin.base64" (Indicator: "base64"; Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp"), Found string "TChamadanaInternet2BarradoExplorer2ConfiguraesdeBloqueadordePopups2SobreoInternetExplorer2de Seguran" (Indicator: "aes"; Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp"), Found string "ECDSA/SHA384" (Indicator: "ecdsa"; Source: "00000000-00003660.00000000.127913.1F9C0000.00000004.mdmp")62:Te2b,Found reference to API "AddressOfEntryPoint" (Indicator: "AddressOfEntryPoint"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000000.127913.26280000.00000004.mdmp, 00000000-00003660.00000000.127913.26760000.00000004.mdmp, 00000000-00003660.00000000.127913.267A0000.00000004.mdmp, 00000000-00003660.00000000.127913.26890000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp, 00000000-00003660.00000001.129833.26280000.00000002.mdmp, 00000000-00003660.00000001.129833.26760000.00000002.mdmp, 00000000-00003660.00000001.129833.267A0000.00000002.mdmp, 00000000-00003660.00000001.129833.26890000.00000002.mdmp, 00000000-00003660.00000001.129833.272B0000.00000002.mdmp, 00000000-00003660.00000001.129833.27350000.00000002.mdmp, 00000000-00003660.00000001.129833.27430000.00000002.mdmp, 00000000-00003660.00000001.129833.31170000.00000002.mdmp, 00000000-00003660.00000001.129833.31270000.00000002.mdmp, 00000000-00003660.00000001.129833.312F0000.00000002.mdmp, 00000000-00003660.00000001.129833.31310000.00000002.mdmp, 00000000-00003660.00000001.129833.31320000.00000002.mdmp, 00000000-00003660.00000001.129833.31330000.00000002.mdmp, 00000000-00003660.00000001.129833.31360000.00000002.mdmp, 00000000-00003660.00000001.129833.31380000.00000002.mdmp, 00000000-00003660.00000001.129833.313B0000.00000002.mdmp, 00000000-00003660.00000001.129833.313C0000.00000002.mdmp, 00000000-00003660.00000001.129833.31400000.00000002.mdmp, 00000000-00003660.00000001.129833.31420000.00000002.mdmp, 00000000-00003660.00000001.129833.31440000.00000002.mdmp, 00000000-00003660.00000001.129833.31450000.00000002.mdmp, 00000000-00003660.00000001.129833.31470000.00000002.mdmp, 00000000-00003660.00000001.129833.31490000.00000002.mdmp, 00000000-00003660.00000001.129833.314B0000.00000002.mdmp, 00000000-00003660.00000001.129833.314D0000.00000002.mdmp, 00000000-00003660.00000001.129833.314F0000.00000002.mdmp, 00000000-00003660.00000001.129833.31500000.00000002.mdmp, 00000000-00003660.00000001.129833.31520000.00000002.mdmp, 00000000-00003660.00000001.129833.31530000.00000002.mdmp, 00000000-00003660.00000001.129833.31540000.00000002.mdmp, 00000000-00003660.00000001.129833.31550000.00000002.mdmp, 00000000-00003660.00000001.129833.31570000.00000002.mdmp, 00000000-00003660.00000001.129833.31590000.00000002.mdmp, 00000000-00003660.00000001.129833.315A0000.00000002.mdmp, 00000000-00003660.00000001.129833.315E0000.00000002.mdmp, 00000000-00003660.00000001.129833.315F0000.00000002.mdmp, 00000000-00003660.00000001.129833.31600000.00000002.mdmp, 00000000-00003660.00000001.129833.31610000.00000002.mdmp, 00000000-00003660.00000001.129833.31620000.00000002.mdmp, 00000000-00003660.00000001.129833.31AA0000.00000002.mdmp, 00000000-00003660.00000001.129833.31AC0000.00000002.mdmp, 00000000-00003660.00000001.129833.31AE0000.00000002.mdmp, 00000000-00003660.00000001.129833.31B00000.00000002.mdmp, 00000000-00003660.00000001.129833.31B10000.00000002.mdmp, 00000000-00003660.00000001.129833.31BA0000.00000002.mdmp, 00000000-00003660.00000001.129833.31BD0000.00000002.mdmp, 00000000-00003660.00000001.129833.31C00000.00000002.mdmp, 00000000-00003660.00000001.129833.31C20000.00000002.mdmp, 00000000-00003660.00000001.129833.31C30000.00000002.mdmp, 00000000-00003660.00000001.129833.31C40000.00000002.mdmp, 00000000-00003660.00000001.129833.31C50000.00000002.mdmp, 00000000-00003660.00000001.129833.31C60000.00000002.mdmp, 00000000-00003660.00000001.129833.31CA0000.00000002.mdmp, 00000000-00003660.00000001.129833.31D00000.00000002.mdmp, 00000000-00003660.00000001.129833.31E10000.00000002.mdmp")63:T2ab3,Found reference to API "DllGetClassObject" (Indicator: "DllGetClassObject"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000000.127913.26730000.00000004.mdmp, 00000000-00003660.00000000.127913.26760000.00000004.mdmp, 00000000-00003660.00000000.127913.268B0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.25F76000.00000004.mdmp, 00000000-00003660.00000001.129833.26660000.00000002.mdmp, 00000000-00003660.00000001.129833.26740000.00000002.mdmp, 00000000-00003660.00000001.129833.26760000.00000002.mdmp, 00000000-00003660.00000001.129833.26D70000.00000002.mdmp, 00000000-00003660.00000001.129833.28B00000.00000002.mdmp, 00000000-00003660.00000001.129833.28B20000.00000002.mdmp, 00000000-00003660.00000001.129833.28B80000.00000002.mdmp, 00000000-00003660.00000001.129833.28C30000.00000002.mdmp, 00000000-00003660.00000001.129833.28C40000.00000002.mdmp, 00000000-00003660.00000001.129833.28CF0000.00000002.mdmp, 00000000-00003660.00000001.129833.28D10000.00000002.mdmp, 00000000-00003660.00000001.129833.28D20000.00000002.mdmp, 00000000-00003660.00000001.129833.28D40000.00000002.mdmp, 00000000-00003660.00000001.129833.28D70000.00000002.mdmp, 00000000-00003660.00000001.129833.28E10000.00000002.mdmp, 00000000-00003660.00000001.129833.28E20000.00000002.mdmp, 00000000-00003660.00000001.129833.28E60000.00000002.mdmp, 00000000-00003660.00000001.129833.28ED0000.00000002.mdmp, 00000000-00003660.00000001.129833.28F50000.00000002.mdmp, 00000000-00003660.00000001.129833.2A0F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2A110000.00000002.mdmp, 00000000-00003660.00000001.129833.2A120000.00000002.mdmp, 00000000-00003660.00000001.129833.2A140000.00000002.mdmp, 00000000-00003660.00000001.129833.2A1B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2A1C0000.00000002.mdmp, 00000000-00003660.00000001.129833.2A1D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2A1F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2A200000.00000002.mdmp, 00000000-00003660.00000001.129833.2A210000.00000002.mdmp, 00000000-00003660.00000001.129833.2A220000.00000002.mdmp, 00000000-00003660.00000001.129833.2A270000.00000002.mdmp, 00000000-00003660.00000001.129833.2A280000.00000002.mdmp, 00000000-00003660.00000001.129833.2A290000.00000002.mdmp, 00000000-00003660.00000001.129833.2A2A0000.00000002.mdmp, 00000000-00003660.00000001.129833.2A2E0000.00000002.mdmp, 00000000-00003660.00000001.129833.2A310000.00000002.mdmp, 00000000-00003660.00000001.129833.2A320000.00000002.mdmp, 00000000-00003660.00000001.129833.2A360000.00000002.mdmp, 00000000-00003660.00000001.129833.2A370000.00000002.mdmp, 00000000-00003660.00000001.129833.2A390000.00000002.mdmp, 00000000-00003660.00000001.129833.2BEEB000.00000004.mdmp, 00000000-00003660.00000001.129833.2C370000.00000002.mdmp, 00000000-00003660.00000001.129833.2C3A0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C3D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C3E0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C3F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C430000.00000002.mdmp, 00000000-00003660.00000001.129833.2C440000.00000002.mdmp, 00000000-00003660.00000001.129833.2C460000.00000002.mdmp, 00000000-00003660.00000001.129833.2C500000.00000002.mdmp, 00000000-00003660.00000001.129833.2C540000.00000002.mdmp, 00000000-00003660.00000001.129833.2C580000.00000002.mdmp, 00000000-00003660.00000001.129833.2C5E0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C5F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C610000.00000002.mdmp, 00000000-00003660.00000001.129833.2C660000.00000002.mdmp, 00000000-00003660.00000001.129833.2C730000.00000002.mdmp, 00000000-00003660.00000001.129833.2C740000.00000002.mdmp, 00000000-00003660.00000001.129833.2C780000.00000002.mdmp, 00000000-00003660.00000001.129833.2C7C0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C7D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C800000.00000002.mdmp, 00000000-00003660.00000001.129833.2C840000.00000002.mdmp, 00000000-00003660.00000001.129833.2C850000.00000002.mdmp, 00000000-00003660.00000001.129833.2C870000.00000002.mdmp, 00000000-00003660.00000001.129833.2C880000.00000002.mdmp, 00000000-00003660.00000001.129833.2C8B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C8D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C8E0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C8F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C930000.00000002.mdmp, 00000000-00003660.00000001.129833.2C940000.00000002.mdmp, 00000000-00003660.00000001.129833.2C950000.00000002.mdmp, 00000000-00003660.00000001.129833.2C960000.00000002.mdmp, 00000000-00003660.00000001.129833.2C970000.00000002.mdmp, 00000000-00003660.00000001.129833.2C9C0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C9E0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C9F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2CA00000.00000002.mdmp, 00000000-00003660.00000001.129833.2CA70000.00000002.mdmp, 00000000-00003660.00000001.129833.2CAC0000.00000002.mdmp, 00000000-00003660.00000001.129833.2CAE0000.00000002.mdmp, 00000000-00003660.00000001.129833.2CB00000.00000002.mdmp, 00000000-00003660.00000001.129833.2CB70000.00000002.mdmp, 00000000-00003660.00000001.129833.2CB90000.00000002.mdmp, 00000000-00003660.00000001.129833.2CBA0000.00000002.mdmp, 00000000-00003660.00000001.129833.2CC10000.00000002.mdmp, 00000000-00003660.00000001.129833.2CC20000.00000002.mdmp, 00000000-00003660.00000001.129833.2CC40000.00000002.mdmp, 00000000-00003660.00000001.129833.2CCD0000.00000002.mdmp, 00000000-00003660.00000001.129833.2CD70000.00000002.mdmp, 00000000-00003660.00000001.129833.2CD80000.00000002.mdmp, 00000000-00003660.00000001.129833.2CE10000.00000002.mdmp, 00000000-00003660.00000001.129833.2CF40000.00000002.mdmp, 00000000-00003660.00000001.129833.2CF70000.00000002.mdmp, 00000000-00003660.00000001.129833.2CFC0000.00000002.mdmp, 00000000-00003660.00000001.129833.2CFE0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D000000.00000002.mdmp, 00000000-00003660.00000001.129833.2D080000.00000002.mdmp, 00000000-00003660.00000001.129833.2D0B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D190000.00000002.mdmp, 00000000-00003660.00000001.129833.2D1B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D3D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D410000.00000002.mdmp, 00000000-00003660.00000001.129833.2D430000.00000002.mdmp, 00000000-00003660.00000001.129833.2D530000.00000002.mdmp, 00000000-00003660.00000001.129833.2D550000.00000002.mdmp, 00000000-00003660.00000001.129833.2D570000.00000002.mdmp, 00000000-00003660.00000001.129833.2D5B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D5F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D690000.00000002.mdmp, 00000000-00003660.00000001.129833.2D730000.00000002.mdmp, 00000000-00003660.00000001.129833.2D750000.00000002.mdmp, 00000000-00003660.00000001.129833.2D7F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D830000.00000002.mdmp, 00000000-00003660.00000001.129833.2D870000.00000002.mdmp, 00000000-00003660.00000001.129833.2D8F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D930000.00000002.mdmp, 00000000-00003660.00000001.129833.2D950000.00000002.mdmp, 00000000-00003660.00000001.129833.2D990000.00000002.mdmp, 00000000-00003660.00000001.129833.2D9B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D9D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2D9F0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DA90000.00000002.mdmp, 00000000-00003660.00000001.129833.2DAB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DAD0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DB80000.00000002.mdmp, 00000000-00003660.00000001.129833.2DBD0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DCC0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DCF0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DD20000.00000002.mdmp, 00000000-00003660.00000001.129833.2DD50000.00000002.mdmp, 00000000-00003660.00000001.129833.2DD80000.00000002.mdmp, 00000000-00003660.00000001.129833.2DDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DE40000.00000002.mdmp, 00000000-00003660.00000001.129833.2DE70000.00000002.mdmp, 00000000-00003660.00000001.129833.2DEA0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DED0000.00000002.mdmp, 00000000-00003660.00000001.129833.2DF30000.00000002.mdmp, 00000000-00003660.00000001.129833.2DFA0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E000000.00000002.mdmp, 00000000-00003660.00000001.129833.2E030000.00000002.mdmp, 00000000-00003660.00000001.129833.2E090000.00000002.mdmp, 00000000-00003660.00000001.129833.2E120000.00000002.mdmp, 00000000-00003660.00000001.129833.2E1A0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E250000.00000002.mdmp, 00000000-00003660.00000001.129833.2E2D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2E310000.00000002.mdmp, 00000000-00003660.00000001.129833.2E390000.00000002.mdmp, 00000000-00003660.00000001.129833.2E420000.00000002.mdmp, 00000000-00003660.00000001.129833.2E460000.00000002.mdmp, 00000000-00003660.00000001.129833.2E520000.00000002.mdmp, 00000000-00003660.00000001.129833.2E780000.00000002.mdmp, 00000000-00003660.00000001.129833.2E870000.00000002.mdmp, 00000000-00003660.00000001.129833.2EC00000.00000002.mdmp, 00000000-00003660.00000001.129833.2ECD0000.00000002.mdmp, 00000000-00003660.00000001.129833.2EE50000.00000002.mdmp, 00000000-00003660.00000001.129833.2EEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F030000.00000002.mdmp, 00000000-00003660.00000001.129833.2F0B0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F140000.00000002.mdmp, 00000000-00003660.00000001.129833.2F520000.00000002.mdmp, 00000000-00003660.00000001.129833.2F5D0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F850000.00000002.mdmp, 00000000-00003660.00000001.129833.2F950000.00000002.mdmp, 00000000-00003660.00000001.129833.2FB60000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30100000.00000002.mdmp, 00000000-00003660.00000001.129833.301A0000.00000002.mdmp, 00000000-00003660.00000001.129833.301C0000.00000002.mdmp, 00000000-00003660.00000001.129833.30210000.00000002.mdmp, 00000000-00003660.00000001.129833.30310000.00000002.mdmp, 00000000-00003660.00000001.129833.303B0000.00000002.mdmp, 00000000-00003660.00000001.129833.30470000.00000002.mdmp, 00000000-00003660.00000001.129833.31EA0000.00000002.mdmp, 00000000-00003660.00000001.129833.31F10000.00000002.mdmp, 00000000-00003660.00000001.129833.3235D000.00000004.mdmp, 00000000-00003660.00000001.129833.327F6000.00000004.mdmp, 00000000-00003660.00000001.129833.32828000.00000004.mdmp")64:T1842,Found string "netview.exe360netview.dll360safe.execreatecnntviewrsion\run\shellrun.antifuckyou&password=&money=" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "3!|server: spybotsoftware\kazaa\localcontentprivmsgregisterserviceprocess\cmd.exekeylogger startedsynflooding:wnetenumcachedpasswordsspybot1.2cstartkeyloggeravp_crack.exezoneallarm_pro_crack.exe" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "c:\windows\keylog.txtfucking errorFound Tiberian Sun CDKey (%s).JOIN %s %sPRIVMSG %s :invalid nick!Keylogger logging to %s[nt-scan] not currently scanninguserpasswordUGLY BOT 1.0 by eric and vice" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "6Sfinanzportal.fiducia.deinternetsube.akbank.com.trbankofamericaclicks=%syapikredi.com.tr%s=keylogged:%s keysread:%spasswordie auto complete fieldsie:password-protected sitesdeleted oe account/upload.php/mail.php" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "ep_account_noep_password_kg\0.bmp/count.asp?mac=http://110.34.232.11:1314inidirectbankui60.dll" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "accept-language: zh-cnpassworddlgtrojankillerhttpqzhengtucurrentcontrolset\control\sessionHookvirtualprotectex" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "9account=%s&password1=%s&password2=%s&specialsign=%s&cash=%d&client=&server=%s&inputsource=%s&levels=%d&name=%s&other=%s&verify=%sact=getpos&account=%s" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "?act=getover&account=elementclient.exe\Data\id.ini?act=getpos&account=%sserver=%s&account=%s&password1=%s&ProtPass=%s&Verify=%s%s?s=%s?act=getthmbok&account=\userdata\currentserver.ini" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "&password2=" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "server=%s&account=%s&password1=%s&password2=%s&levels=%s&cash=%s&" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "account=%s&password" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "&account=%s&passwordpost.asp&cash=%s" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "servicerouteexaccount=%s&password" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "=%s&password" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string ")password=matrix51;persist security info=true;controle_msn_auto1" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "Frase secretaConta CorrenteDIGITE TODASE-Banking instaladoNextPart_2altrfkindyvisat.com.br" (Indicator: "secret"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "sausernamepassword" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "password%08x.~tpxxx" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "litizador:cod. secreto:https://caixadirecta.cgd.pt200.13.244.245/cw-assenda/bin/es202.96.164.70/bbs" (Indicator: "secret"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string "Digite sua senha de 4 dBradesco by D4RiOgitos. Por favor, utilize o Teclado Virtual.Informe sua frase secretaO Banco Bradesco agradece a sua colabora" (Indicator: "secret"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string "rojetos mr.nobody\nobody bho\lixo bho\uiemonitor.passoftware\microsoft\windows\currentversion\explorer\browser helper objects\login_password=senha2=senha-passaporte=" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "=ws7otbxsx.dlls7_get_passwords7h_start_cpu" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "bsantaragama23provider=sqloledb.1;password=User ID=kidkid;;data source=184.22.136.226,1039Dados InvalidosST_ENVIADO=" (Indicator: "password"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp")65:Ta30,Found string "C ping localhost -n %u && del "%s"wmic.exe /output:clipboard process call create "powershell -w hidden iex(ShellExec_RunDLL "cmd" /c start /min powershell iex(" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "sc start" (Indicator: "sc start"; Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp") Found string "netstat -anoSYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List127.0.0.1 www.login.vk.comDnsServer_11dns/send_p.php?sid=knock.php?ip=" (Indicator: "netstat"; Source: "00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp") Found string "PING" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp") Found string "oftware\Microsoft\Windows\CurrentVersion\Run[endof]|'|'|.exe /k ping 0 & del "netsh firewall add allowedprogram 0.4.1a1177" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp"), Found string "ENTER]cmd.exe /k ping 0 & del" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp"), Found string "ipconfig /renew" (Indicator: "ipconfig"; Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp"), Found string "etsh firewall add allowedprogram "cmd.exe /k ping 0 & del "" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp"), Found string "ping 0 & del "" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp") Found string "ping 0 -n" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp") Found string "ping 127.0.0.1 & del "" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp"), Found string "ping" (Indicator: "ping"; Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp 00000000-00003660.00000000.127913.271F0000.00000004.mdmp 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp 00000000-00003660.00000001.129833.26370000.00000002.mdmp 00000000-00003660.00000001.129833.270F0000.00000002.mdmp 00000000-00003660.00000001.129833.29480000.00000002.mdmp")66:T4b8,"turboftp\addrbk.dat" (Indicator: "addrbk.dat") "id=%s&id=%s&id=%s&id=%s&id=%s&id=%s\win.ini" (Indicator: "\win.ini") "qvxbkyxrlihnlcnzpy2u=xhdpbnn2y2hvc3rcc3zjag9zdc5legu=l2dldgntzc5waha//\smartftp\client 2.0\favorites\quick connect\*.xml\filezilla\recentservers.xmlprogram=flashfxp&website=\ghisler\wcx_ftp.inis\estsoft\alftp\qdata.datlmh0dhbmbg9vza==lnbvc3rodhrwzmxvb2q=xfdpblnvy2tzlnn3lnvwzgf0zq==lmrvd25sb2fku3lzdgvtlmv4zq==" (Indicator: "\estsoft\alftp") "qvxbkyxrlihnlcnzpy2u=xhdpbnn2y2hvc3rcc3zjag9zdc5legu=l2dldgntzc5waha//\smartftp\client 2.0\favorites\quick connect\*.xml\filezilla\recentservers.xmlprogram=flashfxp&website=\ghisler\wcx_ftp.inis\estsoft\alftp\qdata.datlmh0dhbmbg9vza==lnbvc3rodhrwzmxvb2q=xfdpblnvy2tzlnn3lnvwzgf0zq==lmrvd25sb2fku3lzdgvtlmv4zq==" (Indicator: "\smartftp") "qvxbkyxrlihnlcnzpy2u=xhdpbnn2y2hvc3rcc3zjag9zdc5legu=l2dldgntzc5waha//\smartftp\client 2.0\favorites\quick connect\*.xml\filezilla\recentservers.xmlprogram=flashfxp&website=\ghisler\wcx_ftp.inis\estsoft\alftp\qdata.datlmh0dhbmbg9vza==lnbvc3rodhrwzmxvb2q=xfdpblnvy2tzlnn3lnvwzgf0zq==lmrvd25sb2fku3lzdgvtlmv4zq==" (Indicator: "qdata.dat") "PokerStars\user.iniTurboFTP\addrbk.dat" (Indicator: "addrbk.dat")67:T2dc3,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000000.126142.D60A0000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D60A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000000.126142.D60A0000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D60A0000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp") Found string "\Device\HarddiskVolume2\windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Indicator: "\Device\"; Source: "00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000000.127913.1D830000.00000004.mdmp, 00000000-00003660.00000000.127913.1F7C0000.00000004.mdmp, 00000000-00003660.00000000.127913.1FD00000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D830000.00000004.mdmp, 00000000-00003660.00000001.129833.1F7C0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FD00000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000000.127913.1D830000.00000004.mdmp, 00000000-00003660.00000000.127913.1F7C0000.00000004.mdmp, 00000000-00003660.00000000.127913.1FD00000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D830000.00000004.mdmp, 00000000-00003660.00000001.129833.1F7C0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FD00000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\MRT.exe" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.127913.1D560000.00000004.mdmp") Found string "system32\drivers\etc\hostsc:\users\w7\desktop\hosts\project1.vbpw" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "system32\drivers\etc\hostsc:\users\w7\desktop\hosts\project1.vbpw" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "dosdevices\new_drv\device\new_drv" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "HttpSendRequestAInternetReadFile\dvp.log\system32\drivers\etc\hostsVolk, ein REICH, ein Fuhrer !!!dvpd.DLL" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "HttpSendRequestAInternetReadFile\dvp.log\system32\drivers\etc\hostsVolk, ein REICH, ein Fuhrer !!!dvpd.DLL" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.127913.1D820000.00000004.mdmp") Found string "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry\Machine\SYSTEM\CurrentControlSet\Services\runtime2runtime2.sy_\SystemRoot\Temp\startdrv.exe\Temp\startdrv.exe\SystemRoot\system32\drivers\runtime2.sys\Device\Rntm2u" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry\Machine\SYSTEM\CurrentControlSet\Services\runtime2runtime2.sy_\SystemRoot\Temp\startdrv.exe\Temp\startdrv.exe\SystemRoot\system32\drivers\runtime2.sys\Device\Rntm2u" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry\Machine\SYSTEM\CurrentControlSet\Services\runtime2runtime2.sy_\SystemRoot\Temp\startdrv.exe\Temp\startdrv.exe\SystemRoot\system32\drivers\runtime2.sys\Device\Rntm2u" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "device\m5\device\main35\dosdevices\m5\dosdevices\main35c" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "device\m5\device\main35\dosdevices\m5\dosdevices\main35c" (Indicator: "\DosDevices\"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "DosDevices\Rntm3\Device\Rntm3\FileSystemWLCtrl32.dll" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "\drivers\port25" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "\Winlogon\Notify\WinNt32\SystemRoot\system32\WinData.cab\DosDevices\Prot2s" (Indicator: "\DosDevices\"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "WinNt32.dll\Device\Prot2" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "\DosDevices\Prot3" (Indicator: "\DosDevices\"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "\device\" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000000.127913.273A0000.00000004.mdmp, 00000000-00003660.00000000.127913.273B0000.00000004.mdmp, 00000000-00003660.00000000.127913.273C0000.00000004.mdmp, 00000000-00003660.00000000.127913.273D0000.00000004.mdmp, 00000000-00003660.00000000.127913.27410000.00000004.mdmp, 00000000-00003660.00000000.127913.27420000.00000004.mdmp, 00000000-00003660.00000000.127913.27440000.00000004.mdmp, 00000000-00003660.00000000.127913.27570000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp, 00000000-00003660.00000001.129833.27050000.00000002.mdmp, 00000000-00003660.00000001.129833.27070000.00000002.mdmp, 00000000-00003660.00000001.129833.27090000.00000002.mdmp, 00000000-00003660.00000001.129833.270C0000.00000002.mdmp, 00000000-00003660.00000001.129833.27340000.00000002.mdmp, 00000000-00003660.00000001.129833.27400000.00000002.mdmp, 00000000-00003660.00000001.129833.27450000.00000002.mdmp, 00000000-00003660.00000001.129833.274A0000.00000002.mdmp, 00000000-00003660.00000001.129833.274B0000.00000002.mdmp, 00000000-00003660.00000001.129833.274D0000.00000002.mdmp, 00000000-00003660.00000001.129833.274E0000.00000002.mdmp, 00000000-00003660.00000001.129833.27530000.00000002.mdmp, 00000000-00003660.00000001.129833.31AB0000.00000002.mdmp") Found string "\dosdevices\\registry\machine\software\microsoft\windows nt\currentversion\winlogon\notify\winctrl32\systemroot\system32\winctrl32.dllexeresourceimpersonatestartshell" (Indicator: "\DosDevices\"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "\device\devhbkernel32" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp") Found string "c:\windows\system32\drivers\" (Indicator: "\drivers\"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp, 00000000-00003660.00000001.129833.262D0000.00000002.mdmp, 00000000-00003660.00000001.129833.29470000.00000002.mdmp") Found string "c:\windows\system32\drivers\" (Indicator: "system32\drivers"; Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp, 00000000-00003660.00000001.129833.262D0000.00000002.mdmp, 00000000-00003660.00000001.129833.29470000.00000002.mdmp") Found string "\device\msdirectx\device\bbbsys32d" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "\device\harddiskvolume1\arquivos de programas\gbplugin\G" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "device\harddiskvolume1\program files\gbplugin\device\harddiskvolume1\arquivos de programas\gbplugin\gbpsv.exe\gbieh.dll\gbpdist.dll\gbieh.gmd\bb.gpc\abn.gpc\cef.gpc\gbiehabn.dll\gbiehcef.dll\gbiehisg.dll\isg.gpc" (Indicator: "\Device\"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp")68:T55f,Observed string: "(n[^myapp.exe /c del "c:\myapp.exe"c:\program files\netmeeting\ravytmon.cfgc:\program files\netmeeting\ravytmon.exezhengtu.datmzkernel32.dllstrrchrAVP.TrafficMonConnectionTermAVP.Button" (Indicator: "/c del ") in Source: 00000000-00003660.00000000.127913.1F140000.00000004.mdmp 00000000-00003660.00000001.129833.1F140000.00000002.mdmp Observed string: "cfiustartserviceacmd /c del c:\myapp.exe%systemroot%\system32\svchost.exe -k netsvcssoftware\microsoft\windows nt\currentversion\svchost" (Indicator: "cmd /c del") in Source: 00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp Observed string: "cfiustartserviceacmd /c del c:\myapp.exe%systemroot%\system32\svchost.exe -k netsvcssoftware\microsoft\windows nt\currentversion\svchost" (Indicator: "/c del ") in Source: 00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp Observed string: "/c del get /40h" (Indicator: "/c del ") in Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp Observed string: "ownload and runexecute cmd.exeor,/c del %temp%\*.vbs" (Indicator: "/c del ") in Source: 00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp69:T641,Found string "AntiVirus.EXE" (Indicator: "antivir"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "Blackd" (Indicator: "blackd"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "Blackice" (Indicator: "blackice"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "Zonealarm" (Indicator: "zonealarm"; Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "norton recebeu 0 - frm_servi" (Indicator: "norton"; Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp") Found string "avp32.exe" (Indicator: "avp32"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp") Found string "antivirusdisablenotify" (Indicator: "antivir"; Source: "00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp") Found string "antivir" (Indicator: "antivir"; Source: "00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp, 00000000-00003660.00000001.129833.25330000.00000002.mdmp")6a:Taca,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\MRT.EXE"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "ENABLEDHCP"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "MRT.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")6b:T1423,"tp.enigmasbr.comh" (Source: 00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, Indicator: "sbr.com") "ftp.enigmasbr.comf" (Source: 00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, Indicator: "sbr.com") "ttps://wwwss.bradesco.com.br/ - Internet Explorer\Vermelho.vbpt" (Source: 00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp, Indicator: "bradesco.com.br") "ao com erro\prjmain.vbpwww.banespa.com.brerror. compruebe los datos del servidor ftp sin son correctos" (Source: 00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp, Indicator: "banespa.com.br") "msnmsgr.exehttp://www.bb.com.br/portalbbhttp://www.bradesco.com.brhttp://www.unibanco.com.brhttp://www.itau.com.brhttps://internetbanking.caixa.gov.brhttp://www.nossacaixa.com.br" (Source: 00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp, Indicator: "bradesco.com.br") "ww.bradescoempresas.com.brwww.corporatebradesco.com.brbradesco net empresa=" (Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, Indicator: "bradesco.com.br") "ttps://bankline.itau.com.br/gripnet/bklcgi.exee" (Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, Indicator: "itau.com.br") "hwmgwm12.exehttp://www.itau.com.brn" (Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, Indicator: "itau.com.br") "frame1.exewww.hsbc.com.brbradesco.com.brwww.nossacaixa.com.brwww.orkut.comd" (Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, Indicator: "bradesco.com.br") "bradesco.com.br" (Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp, 00000000-00003660.00000001.129833.26380000.00000002.mdmp, Indicator: "bradesco.com.br") "csrc="https://itaubankline.itau.com.br/V1/PERS/IMG/bt_confirmar.gifclass=corpo_texto_destacadobotao_confirmar_OnClickimgTeclado01_OnClickGbPluginObj.Digest(""); document.botaoEntrar_OnClickIEBrowserEvents.dll" (Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp, Indicator: "itau.com.br"), "okartsrus.com/images/bang.phppraquem=dlkownz8@gmail.comO site "http://www.bradesco.com.br" diz:" (Source: 00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp, Indicator: "bradesco.com.br"), "openbank.eslacaixa.esbancoreal.com.brnossacaixa.com.britauprivatebank.com.brunibanco.com.bramericanas.com" (Source: 00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp, Indicator: "bancoreal.com.br"), "www.bradesco.com.br" (Source: 00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp, Indicator: "bradesco.com.br"), "https://www.bnet.bradesco.com.br/paginasgeral/servicomenuinicial.do?ctl=" (Source: 00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp, Indicator: "bradesco.com.br"), "o se puede conectar. verifique el nombre de usuariohttp://www.youtube.com/watch?v=bradescoprime.com.brsantander.com.brwww.bb.com.britaupersonnalite.com.brcef.gov.brinternetbanking.caixa.gov.britau.com.br" (Source: 00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp, Indicator: "itau.com.br"), "itau.com.br" (Source: 00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp, Indicator: "itau.com.br"), "portal.lacaixa.es" (Source: 00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp, Indicator: "lacaixa.es"), "b2.bradesco.com.br/ibpfloginb" (Source: 00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp, Indicator: "bradesco.com.br"), "bankline.itau.com.br/lgnet" (Source: 00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp, Indicator: "itau.com.br"), "Halert("Senha InvalidaFechar_OnClick\tudo\bhobankline.itau.com.brUPDATE AMARELONOVO SETlkMinhaSegurancaes sobre os seus investimentosrentabilidade de fundos" (Source: 00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp, Indicator: "itau.com.br") "interbank.com.pe" (Source: 00000000-00003660.00000000.127913.1F350000.00000004.mdmp, Indicator: "interbank.com.pe")6c:Tef9,Found string "FDICreate" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: CABINET.DLL) Found string "FDICopy" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: CABINET.DLL) Found string "FDIDestroy" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: CABINET.DLL) Found string "GetTempPath2W" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: KERNELBASE.DLL) Found string "GetFileVersionInfoSizeExW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoSizeW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoExW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: VERSION.DLL) Found string "VerQueryValueW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: VERSION.DLL) Found string "WTHelperGetProvSignerFromChain" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: WINTRUST.DLL) Found string "LCMapStringEx" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: KERNELBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: UCRTBASE.DLL) Found string "NtSetInformationFile" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: NTDLL.DLL) Found string "RegDeleteValueW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: ADVAPI32.DLL) Found string "AllocateAndInitializeSid" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: ADVAPI32.DLL) Found string "CheckTokenMembership" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: ADVAPI32.DLL) Found string "CopySid" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: ADVAPI32.DLL) Found string "FreeSid" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: ADVAPI32.DLL) Found string "GetLengthSid" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: ADVAPI32.DLL) Found string "GetVolumeInformationW" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: KERNELBASE.DLL) Found string "DeviceIoControl" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: KERNELBASE.DLL) Found string "LoadResource" (Source: windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe, API is part of module: KERNELBASE.DLL)6d:T1121,"MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e01e5c1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1f7d1850" "pszBlobType": "RSAPUBLICBLOB" "phKey": "701b5d1d4f020000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80175d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0155d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50175d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90135d1d4f020000" "pbInput": "RSA1" "cbInput": "411" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1f7d1850" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00135d1d4f020000" "pbInput": "RSA1" "cbInput": "419" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1f7d1850" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50145d1d4f020000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0165d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0145d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90195d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00165d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30195d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1f7d1850" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60195d1d4f020000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1f7d1850" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b01d5d1d4f020000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80205d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@!]" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "301f5d1d4f020000" "pbInput": "RSA1" "cbInput": "411" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1f7d1850" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0205d1d4f020000" "pbInput": "RSA1" "cbInput": "419" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1f7d1850" "pszBlobType": "RSAPUBLICBLOB" "phKey": "301f5d1d4f020000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "301f5d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "MRT.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "24f1d5b0d50" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0205d1d4f020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"}6e:T4d1,"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe" wrote 28672 bytes starting with PE header signature to file "C:\Windows\System32\MRT.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MRT.exe" wrote 4280 bytes starting with PE header signature to file "C:\Windows\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MPGEAR.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MRT.exe" wrote 35688 bytes starting with PE header signature to file "C:\Windows\System32\MRT\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\MPENGINE.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000400100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6f:T9b7,Found string "]CurrentVersion\WinSetupReferer: http://%s%s{display:none}http://%s:%d/%s__rr_bot__netsh firewall set allowedprogram %s enable" (Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "netsh firewall set allowedprogram '/cj{" (Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "netsh firewall set allowedprogram "%s" enable" (Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp") Found string "netsh firewall set allowedprogram "%ssysinter" (Source: "00000000-00003660.00000000.127913.1F140000.00000004.mdmp 00000000-00003660.00000001.129833.1F140000.00000002.mdmp"), Found string "netsh firewall set allowedprogram "%s" enablehttp%s://%s%s%s%s%s" (Source: "00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp"), Found string "DisableTaskMgr.php?affid=%u%s%s%stibs.jpg?affid=%u&code1=%c%c%c%cnetsh firewall set allowedprogram '%s'" (Source: "00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp"), Found string "Dados de aplicativos\netsh firewall add allowedprogramARQUIVO OKORKUT" (Source: "00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp"), Found string "oftware\Microsoft\Windows\CurrentVersion\Run[endof]|'|'|.exe /k ping 0 & del "netsh firewall add allowedprogram 0.4.1a1177" (Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp") Found string "advfirewall firewall add rule name="Windows Update Service" dir=in action=allow program="name="Windows Update Service" mode=ENABLE scope=ALL profile=ALL\msiexec.exe\netsh.exe" (Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp"), Found string "netsh firewall add allowedprogram -c -ssh -2 -p 22 -i **referencia card**hsbc bank brasil s.a. - banco mbanco santander s.a.(n_user, n_pass) values (:user, :pass)http://promote.orkut.com/preview?nt=orkut.com&tt=numero card....:creditform:cardnumber" (Source: "00000000-00003660.00000000.127913.1F350000.00000004.mdmp"), Found string "netsh firewall add allowedprogram "cmd.exe /" (Source: "00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp")70:Tab2,"MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "MRT.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "MRT.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")71:Tf3f,YARA signature "Typical_Malware_String_Transforms" matched process "00000000-00003660" as "Detects typical strings in a reversed or otherwise modified form" (Reference: Internal Research) YARA signature "mimikatz_lsass_mdmp" matched process "00000000-00003660" as "LSASS minidump file for mimikatz" YARA signature "ZXProxy" matched process "00000000-00003660" YARA signature "Mimikatz_Memory_Rule_1" classified process "00000000-00003660" as "sekur" YARA signature "Hacktool_Strings_p0wnedShell" matched process "00000000-00003660" as "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs" (Reference: https://github.com/Cn33liz/p0wnedShell) YARA signature "IMPLANT_4_v7" classified process "00000000-00003660" as "apt,apt28" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE) YARA signature "APT9002Strings" classified process "00000000-00003660" as "apt,9002" YARA signature "APT9002" classified process "00000000-00003660" as "apt,9002" YARA signature "SType_Backdoor" classified process "00000000-00003660" as "apt,duststorm" YARA signature "Sakula" classified process "00000000-00003660" as "rat,sakula" YARA signature "Trojan_Win32_PlaSrv" classified process "00000000-00003660" as "apt,platinum" YARA signature "Trojan_Win32_Platual" classified process "00000000-00003660" as "apt,platinum" YARA signature "Trojan_Win32_PlaKeylog_B" classified process "00000000-00003660" as "apt,platinum" YARA signature "Fireball_gubed" classified process "00000000-00003660" as "fireball,adware" (Reference: https://goo.gl/4pTkGQ) YARA signature "jar_jrat_g0" classified process "00000000-00003660" as "rat,jrat" YARA signature "Stuxnet_Malware_3" classified process "00000000-00003660" as "apt,stuxnet" (Reference: Internal Research) YARA signature "Xtreme" classified process "00000000-00003660" as "rat,xtreme" YARA signature "Turla_APT_srsvc" classified process "00000000-00003660" as "apt,turla,ruag" (Reference: https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case) YARA signature "apt_Turla" classified process "00000000-00003660" as "apt,turla,carbon,cobra" YARA signature "APT9002Code" classified process "00000000-00003660" as "apt,9002" YARA signature "easterjackpos" classified process "00000000-00003660" as "pos,easterjackpos" YARA signature "IMPLANT_4_v1" classified process "00000000-00003660" as "apt,apt28" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE) YARA signature "NSFreeStrings" classified process "00000000-00003660" as "nsfree" YARA signature "Codoso_CustomTCP_4" classified process "00000000-00003660" as "apt,codoso" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks) YARA signature "Wabot" classified process "00000000-00003660" as "wabot" YARA signature "RegSubDatStrings" classified process "00000000-00003660" as "regsubdat" YARA signature "nAspyUpdateStrings" classified process "00000000-00003660" as "naspy" YARA signature "pdb_strings_Rescator" classified process "00000000-00003660" as "pos,rescator" YARA signature "IMPLANT_6_v1" classified process "00000000-00003660" as "apt,apt28" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE) YARA signature "apt_hellsing_implantstrings" classified process "00000000-00003660" as "apt,hellsing" YARA signature "IMPLANT_5_v3" classified process "00000000-00003660" as "apt,apt28,xtunnel" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE) YARA signature "PlugXBootLDRCode" classified process "00000000-00003660" as "plugx" YARA signature "APT_DeputyDog_Fexel" classified process "00000000-00003660" as "apt,deputydog" YARA signature "APT_DeputyDog" classified process "00000000-00003660" as "apt,deputydog"72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAD/B3d3d3d3AAAAAAAAAAAAD3d3d3d3d3d3AAAAAAAAAAD3d3d3d3d3iIiLAAAAAAAAD4d3eIh7u4iIi7t3AAAAAIiId+h4i7uIiIu7d3cAAACIiHiIuIu4i4iLu3d3AACAiIiHiIiLuIuIi7t3dwAIiIiHiIiIizNzeLu3d3cAiI+HOIiIuLMxETMzN3d3AIiIiDiIiDMzMzMzEROHdwCIiIg4izMzMzMzMzN+7ncIiAiIMzMzMzMzMzN+7u53CIiIiDMzMzMzMzN+7u7ndwiIiIgzMzMzMzeIiI7u53cIiIiIiOiId3eIiIiIjod3CIiIiIjoiIiIiIiIiIiHdwAAiIiIiIiIiIiIiIiIh3eIgIiIiIiIiIiIiIiIiId3iIh3iIiIj4iIiIiIiIiHeIiIeIiIiPiIiIiIiIiIh3iIiIiIiIiIiP///4iIiId4iIiPh4iIiP/////4iIh3iACIiId3iIiI/////4iId3cIiI+Id3d3eIiP///4iHd3CIh/iACId3d3eIiIiIh3dwCAiI8AAACIh3d3d4iId4cAAIiHeIgAAACIh3d3d3eHAACIgIiPhwAAAAiIh3d4hwAAAACIj4B3d3AAAIiIiHcAAAAACIiAAAAAf/AAAPh3AAAAAAAAAAAAAAd3dwB3dwAAAAAAAAAAAAAAAAAAAADyAD//+AAD//wAAD/+AAAD/AAAAPwAAAD0AAAA4AAAAMAAAADAAAAAwAAAAIgAAACAAAAAgAAAAIAAAACAAAAA8AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAIAAAACAwAAA0PwAAPAPwADxA/gA/wQfAP+H8fD///gw/////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1794358266042,"unified_at":"2026-11-11T00:51:06.042Z","metadata":{"hashes":{"sha256":"79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","sha1":"363852203832b66685bd516c63595435b7ae1a8a","md5":"253a4c61f929dd9dc52cb8437d44965b","sha512":"e9a0195358354f6f108cdd6c20be67cef254f543941a288d4af55662d217ec63e9c80600d211fadb038ace2f3300e1212a2c4d064ad8e7127b15ab7e6afc87ca","ssdeep":"Unknown","imphash":"0aa660660ee0df39262af5789d20319b","pehash":"e3d79eafed34a2b18cb7f272d14b920d6439497e"},"file_info":{"file_name":"Windows-KB890830-x64-V5.147.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":90831768,"entropy":8,"compile_timestamp":"2026-10-28T19:29:57","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794333771000,"last_seen":1794358241000,"last_multi_scan":1794358241000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":185538,"raw_size":188416},{"name":".rdata","virtual_address":"0x2f000","virtual_size":77370,"raw_size":77824},{"name":".data","virtual_address":"0x42000","virtual_size":10384,"raw_size":8192},{"name":".pdata","virtual_address":"0x45000","virtual_size":10284,"raw_size":12288},{"name":".fptable","virtual_address":"0x48000","virtual_size":256,"raw_size":4096},{"name":".rsrc","virtual_address":"0x49000","virtual_size":89728136,"raw_size":89731072},{"name":".reloc","virtual_address":"0x55dc000","virtual_size":2040,"raw_size":4096}],"section_names":[".text",".rdata",".data",".pdata",".fptable",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":["uroburos","wabot","barium","irontwilight","venomousbear","naspy","carbon","webshell","adware","winntigroup","apt","rat","wcry","regsubdat","wannacry","banker","swallowtail","zeus","sekur","tg-4127","morpho","tsarteam","zeus1134","wickedspider","wildneutron","9002","uroboros","sofacy","sandworm","jrat","tailgater","happyyongzi","cvnx","pos","butterfly","xtreme","fireball","stuxnet","rescator","unit78020","xtunnel","waterbug","cycldek","strontium","pfinet","ragebeast","poisonivy","sakula","blackfly","lead","wraith","wickedpanda","krypton","hippoteam","sednit","apt17","cobra","group-4127","redapollo","terracota","apt19","nsfree","cerber","hellsing","apt10","sunshopgroup","platinum","tag_0700","c0d0so","ruag","deputydog","apt28","dogfish","easterjackpos","pwdump","sphinxmoth","turlagroup","codoso","twoforone","fancybear","group88","potassium","financial","nionspy","snake","gh0st","telebots","stonepanda","wanacrypt0r","fgdump","turla","group74","group72","pawnstorm","turlateam","goblinpanda","tailgaterteam","trickbot","plugx","duststorm","hacktool","ransomware","tag_0530","axiom","menupass","evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":102},"sandbox_signatures":{"informative_count":251,"suspicious_count":9,"malicious_count":7,"total":267},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to identify Internet Explorer version from registry"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Able to create or schedule tasks using domain/system privileges"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"informative","value":"YARA signature match - Possible payload download using Office macros"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Persistence","technique":"Web Shell","attack_id":"T1505.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/003","identifiers":[{"type":"malicious","value":"YARA signature match - China Chopper web shell"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains reference to shellcode"},{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"},{"type":"informative","value":"Able to hide C2 connections by leveraging external proxy routing"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"suspicious","value":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"informative","value":"Contains ability to query sqlite firefox history"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Contains ability to check internet connectivity"},{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Found Base64 encoding crypto library string in memory"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"malicious","value":"Found encryption keys in memory dumps"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Hidden File System","attack_id":"T1564.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/005","identifiers":[{"type":"informative","value":"Contains ability to manipulate virtual file system configuration (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"YARA signature match - Base64-encoded PE executable within PE executable"},{"type":"informative","value":"Sample/File contains another embedded binary"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"informative","value":"YARA signature match - Embedded PDF document"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify System Firewall","attack_id":"T1686","attack_id_wiki":"https://attack.mitre.org/techniques/T1686","identifiers":[{"type":"suspicious","value":"Able to modify firewall settings"},{"type":"informative","value":"Found registry location string related to firewall policy"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"ProcessList\" (Indicator: \"ProcessList\"; Source: \"sample.bin\"), Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.x86\" in Source: sample.bin, \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.arm64\" in Source: sample.bin, \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\PersistentDynamicInstalled\\MSRT.arm64\" in Source: sample.bin, \"Software\\Microsoft\\Windows Defender\\MpEngine\" in Source: sample.bin, \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\" in Source: sample.bin, \"Software\\Microsoft\\Microsoft Antimalware\\MpEngine\" in Source: sample.bin, \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\PersistentDynamicInstalled\\MSRT.amd64\" in Source: sample.bin, \"Software\\Microsoft\\RemovalTools\\MRT\" in Source: sample.bin, \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\PersistentDynamicInstalled\\MSRT.x86\" in Source: sample.bin, \"Software\\Microsoft\\Windows Defender\\Features\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mrtstub.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"sample.bin\"), Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"sample.bin\"), Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \".?AVCSimpleMapItem@CCmdOptionsLookupMap@CommonUtil@@\" (Indicator: \"nslookup\"; Source: \"sample.bin\"), Found string \".?AUICmdOptionsLookup@CommonUtil@@\" (Indicator: \"nslookup\"; Source: \"sample.bin\"), Found string \".?AVCCmdOptionsLookupMap@CommonUtil@@\" (Indicator: \"nslookup\"; Source: \"sample.bin\"), Found string \".?AV?$CRefObjectFor@UICmdOptionsLookup@CommonUtil@@@CommonUtil@@\" (Indicator: \"nslookup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-430","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"sample.bin\"), Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\CABINET\\; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"]vzf.cu\", Heuristic match: \"p2.af\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertVerifyCertificateChainPolicy\" (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"ExtrairEDecompressionError\" (Source: \"00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"getwindowthreadprocessidlookupprivilegevalueaCreateRemoteThreadopenprocesstokenCreateThreadfindwindowaopenprocessKillTimersettimer=%s&r=%s&l=%s&m=%s&r=%s&l=%d&m\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"FindResourceW\" with parameter \"140697141443480\" - (UID: 00000000-00002768)\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"FindResourceW\" with parameter \"140697141443536\" - (UID: 00000000-00002768)\n \"MRT.exe\" called \"FindResourceW\" with parameter \"2538818168480\" - (UID: 00000000-00003660)\n \"MRT.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003660)\n \"MRT.exe\" called \"FindResourceW\" with parameter \"89\" - (UID: 00000000-00003660)\n \"MRT.exe\" called \"FindResourceW\" with parameter \"88\" - (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140697141547336'}\" (UID: 00000000-00002768)\n \"MRT.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140697164752488'}\" (UID: 00000000-00003660)\n \"MRT.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140697164752504'}\" (UID: 00000000-00003660)\n \"MRT.exe\" called \"LoadResource with parameter {'hModule': '140697163792384', 'hResInfo': '140697164760312'}\" (UID: 00000000-00003660)\n \"MRT.exe\" called \"LoadResource with parameter {'hModule': '140697163792384', 'hResInfo': '140697164763768'}\" (UID: 00000000-00003660)\n \"MRT.exe\" called \"LoadResource with parameter {'hModule': '140697163792384', 'hResInfo': '140697164763384'}\" (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"getwindowthreadprocessidlookupprivilegevalueaCreateRemoteThreadopenprocesstokenCreateThreadfindwindowaopenprocessKillTimersettimer=%s&r=%s&l=%s&m=%s&r=%s&l=%d&m\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to manipulate virtual file system configuration (API string)","description":"Found reference to API \"ObOpenObjectByName.\" (Indicator: \"ObOpenObjectByName\"; Source: \"00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.005","relevance":1,"id":"string-456","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found Base64 encoding crypto library string in memory","description":"Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00003660.00000001.129833.26CF0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1132.001","relevance":2,"id":"memorydump-11","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"MRT.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"MRT.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"t.new.A|SCPT:JS/Obfuscator.Split.fromCharCode.A)&SCPT:JS/catch.empty.B\" (Indicator: \"fromcharcode\"; Source: \"00000000-00003660.00000000.127913.1FBC0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FBC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00003660-00000C2C-703084101\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00003660-00000C2C-703084269\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002768.00000000.126142.D5E70000.00000004.mdmp, 00000000-00002768.00000001.128063.D5E70000.00000004.mdmp, 00000000-00002768.00000002.129984.D5E70000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000001.129833.1D560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: YARA signature match - PowerShell with Base64 encoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"findfirsturlcacheentryaGetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"enumservicesstatuswfindnextfilewNtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003660.00000000.127913.1D820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000000.127913.26350000.00000004.mdmp, 00000000-00003660.00000000.127913.27170000.00000004.mdmp, 00000000-00003660.00000000.127913.271A0000.00000004.mdmp, 00000000-00003660.00000000.127913.27210000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp, 00000000-00003660.00000001.129833.26350000.00000002.mdmp, 00000000-00003660.00000001.129833.2BEEB000.00000004.mdmp, 00000000-00003660.00000001.129833.31D70000.00000002.mdmp, 00000000-00003660.00000001.129833.31DB0000.00000002.mdmp, 00000000-00003660.00000001.129833.31DC0000.00000002.mdmp, 00000000-00003660.00000001.129833.31DD0000.00000002.mdmp, 00000000-00003660.00000001.129833.31E20000.00000002.mdmp, 00000000-00003660.00000001.129833.31EA0000.00000002.mdmp, 00000000-00003660.00000001.129833.32180000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify Internet Explorer version from registry","description":"Found string \"/\\regsvr32 /scheckexesignaturestaskbarcreated\\software\\microsoft\\windows\\currentversion\\run\\software\\microsoft\\internet explorer\\downloadd\" (Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-898","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"enumservicesstatuswfindnextfilewNtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003660.00000000.127913.1D820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Video ActiveX Object\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")\n Found string \"QueryServiceConfigW\" (File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003660-00000C2C-704402521\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"w_distrib.exesysdriver32_.exeip_list.txtknock_bad3.php?ver=supercarsinfo.netddos_udp_listjPh\" (Indicator: \"sysdriver\"; Source: \"00000000-00003660.00000000.127913.1F350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"MRT.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002768)\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00002768)\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00002768)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002768)\n \"MRT.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"MRT.exe\" called \"IsWow64Process\" with parameter \"3660\" - (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$41","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002768)\n \"MRT.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"MRT.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MPGEAR.DLL]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$43","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"microsoft.xmlhttp\" (Indicator: \"microsoft.xmlhttp\"; Source: \"00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MRT.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumDesktopsA\" (Indicator: \"EnumDesktops\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.2F760000.00000002.mdmp, 00000000-00003660.00000001.129833.30390000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectorys\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"%temp%\\..\\..\\locallow\\cmd.%username%.bat\" (Indicator: \"%username%\"; Source: \"00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp\")\n Found string \"-u %USERNAME% -p %PASSWORD%\" (Indicator: \"%username%\"; Source: \"00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"oftware\\borland\\delphi\\localescontent-disposition: form-data; name=\"%s\"; filename=\"%s\"email=vaivamoslah@gmail.comfrom=inn@oi.com/envia.phptoken inv\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp\n 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to firewall policy","description":"$44","origin":"File/Memory","mitre_attack_id":"T1686","relevance":1,"id":"string-415","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: \\\\?\\%WINDIR%\\SYSTEM32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPENGINE.DLL\n %WINDIR%\\SYSTEM32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPGEAR.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"MRT.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" queried token user identity (UID: 00000000-00002768)\n \"MRT.exe\" queried token user identity (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"MRT.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"LOGONSERVER\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"USERDOMAIN\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"USERNAME\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"USERPROFILE\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"HOMEPATH\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"HOMEDRIVE\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"APPDATA\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"LOCALAPPDATA\"; Value: \"\")\n \"MRT.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"USERDOMAIN_ROAMINGPROFILE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$45","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"MRT.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"MRT.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002768.00000001.128063.9B22F000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002768.00000001.128063.9B22F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"MRT.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6 (UID: 00000000-00003660)\n \"MRT.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51 (UID: 00000000-00003660)\n \"MRT.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT (UID: 00000000-00003660)\n \"MRT.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\\ (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\MRT.exe\"\" - (UID: 00000000-00002768)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$48","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM AntiVirusProductROOT\\SecurityCenter2i\" (Source: 00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp, Indicator: \"select * from antivirusproductroot\\securitycenter2i\")\n \"SELECT * FROM controle_dep_comunicacao WHERE N_MCADDRESS ='\" (Source: 00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp, Indicator: \"select * from controle_dep_comunicacao where n_mcaddress ='\")\n \"INSERT INTO TABELA23 (NM1, NM2, SD) VALUES ('\" (Source: 00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp, Indicator: \"insert into tabela23 (nm1, nm2, sd) values ('\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c c:\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp\")\n Found string \"/decatur/dropnav/start.asp?ip=wait.asp?fecharnavegador=truecmd.exe /c taskkill -f -im iexplore.exe\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExs\" (Indicator: \"MoveFile\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"\\msnmsgr.exeActivateKeyboardLayoutGetWindowThreadProcessIdAA_doMSNTimerListaMSNEnviar\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"RunStartServiceAFindResourceA\" (Indicator: \"StartService\"; Source: \"00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp\")\n Found reference to API \"StartServiceExHBInject32appinit_dlls\" (Indicator: \"StartService\"; Source: \"00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$4b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" (Indicator: \"\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\\") in Source: 00000000-00003660.00000000.127913.1F340000.00000004.mdmp\n 00000000-00003660.00000001.129833.1F340000.00000002.mdmp\n \"ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \"programdata%\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00003660.00000000.127913.1FBC0000.00000004.mdmp\n 00000000-00003660.00000001.129833.1FBC0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"znnpppadeeiiiiieedamapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4c","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"MPENGINE.DLL\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"), Antivirus vendors marked dropped file \"MPGEAR.DLL\" as clean (type is \"PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"MPGEAR.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\globpluginspipe\n Found string - \\\\.\\pipe\\presp%dturn off proactive\\antivirus.takebotguidrdpgetlasterror\n Found string - \\.\\PIPE\\RUN_AS_USER%4.4d-%2.2d-%2.2d %2.2d:%2.2d:%2.2d:S\n Found string - \\.\\pipe\\MS%08X","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"paypal.com.br\" (Indicator: \"paypal.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 15070000\n \"MRT.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 15070000\n \"MRT.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 153A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 165D0000\n \"MRT.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 165D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a32815f87f0000@ntdll.dll\"\n \"220023000000000038a32815f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" was detected as \"Microsoft Cabinet File\" and name: \"Archive\"\n \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"MPGEAR.DLL\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"MPGEAR.DLL\" was detected as \"Microsoft Cabinet File\" and name: \"Archive\"\n \"MPGEAR.DLL\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"MPGEAR.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"MPGEAR.DLL\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"MPGEAR.DLL\" has an writable section named \".data\"\n \"MPGEAR.DLL\" has an writable section named \".didat\"\n \"MPGEAR.DLL\" has an writable section named \".fptable\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"MPGEAR.DLL\" file has an entrypoint instructions - \"mov\tqword ptr [rsp + 8], rbx,mov\tqword ptr [rsp + 0x10], rsi,push\trdi,sub\trsp, 0x20,mov\trdi, r8,mov\tebx, edx,mov\trsi, rcx,cmp\tedx, 1,jne\t0x18004a7e1,call\t0x18004b20c,mov\tr8, rdi,mov\tedx, ebx,mov\trcx, rsi,mov\trbx, qword ptr [rsp + 0x30],mov\trsi, qword ptr [rsp + 0x38],add\trsp, 0x20,pop\trdi,jmp\t0x18004a68c,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x20,mov\trbx, rcx,xor\tecx, ecx,call\tqword ptr [rip + 0x2cc07],mov\trcx, rbx,call\tqword ptr [rip + 0x2cbf6],call\tqword ptr [rip + 0x2cb18],mov\trcx, rax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"MPGEAR.DLL\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\MRT.exe\" [Source: 00000000-00002768-00000BC0-701680412]\n Observed system executable string:\"%WINDIR%\\system32\\MRT.exe\" [Source: 00000000-00002768-00000BC0-701682306]\n Observed system executable string:\"\"%WINDIR%\\system32\\MRT.exe\"\" [Source: 00000000-00002768-00000C47-65783126766]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"MRT.exe\" (UID: 00000000-00003660) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"MRT.exe\" (UID: 00000000-00003660) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"MRT.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"MRT.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"MRT.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"MRT.exe\" (UID: 00000000-00003660)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"MRT.exe\" (UID: 00000000-00003660)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows\" (SHA1: 1D:88:80:AA:23:E5:A8:02:58:50:7B:B4:62:68:F1:77:66:D2:46:BD: (1.2.840.113549.1.1.12); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, O=Microsoft Corporation, CN=Windows Production PCA 2023\" (SHA1: 15:FF:76:5C:4D:B0:7C:DC:ED:DD:86:F9:92:C0:72:F1:E6:98:86:49: (1.2.840.113549.1.1.12); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010\" (SHA1: 3B:1E:FD:3A:66:EA:28:B1:66:97:39:47:03:A7:2C:A3:40:A0:5B:D5: (1.2.840.113549.1.1.11); see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to create or schedule tasks using domain/system privileges","description":"Found string \"J#7\\\\sys\\alg.exeschtasks /create /tn %s /tr %s /sc onlogon /ru \"NT AUTHORITY\\SYSTEM\"\\BK66.logConsentPromptBehaviorAdmin\" (Source: \"00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-675","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"MRT.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" create file \"C:\\Windows\\System32\\MRT.exe\"\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" create file \"%WINDIR%\\System32\\MRT.exe\"\n \"MRT.exe\" create file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPGEAR.DLL\"\n \"MRT.exe\" create file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPENGINE.DLL\"\n \"MRT.exe\" create file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\"\n \"MRT.exe\" create file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\\MpGearSupport_20261110_10300196F817A1-29C7-576D-8D76-30D193EE333F.log\"\n \"MRT.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"MRT.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"MRT.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections\"- Location: [%WINDIR%\\System32\\MRT.exe]- [targetUID: 00000000-00002768]\n \"MPENGINE.DLL\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPENGINE.DLL]- [targetUID: 00000000-00003660]\n \"MPGEAR.DLL\" has type \"PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections\"- Location: [%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPGEAR.DLL]- [targetUID: 00000000-00003660]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" queries basic process information of the \"C:\\windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" (UID: 2768)\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" queries basic process information of the \"C:\\Windows\\System32\\MRT.exe\" (UID: 2768)\n \"MRT.exe\" queries basic process information of the \"C:\\Windows\\System32\\MRT.exe\" (UID: 3660)\n \"MRT.exe\" queries basic process information of the \"C:\\Windows\\System32\\winlogon.exe\" (UID: 3660)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"MRT.exe\" reads file \"c:\\windows\\system32\\mrt\\42f64b14-d154-3b21-1ec6-042e0e0feaf6\\mpgear.dll\"\n \"MRT.exe\" reads file \"c:\\windows\\system32\\mrt\\42f64b14-d154-3b21-1ec6-042e0e0feaf6\\mpengine.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" touched file \"C:\\Windows\\System32\\MRT.exe\"\n \"MRT.exe\" touched file \"C:\\Windows\\debug\\mrt.log\"\n \"MRT.exe\" touched file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPGEAR.DLL\"\n \"MRT.exe\" touched file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPENGINE.DLL\"\n \"MRT.exe\" touched file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\"\n \"MRT.exe\" touched file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\\MpGearSupport_20261110_10300196F817A1-29C7-576D-8D76-30D193EE333F.log\"\n \"MRT.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"MRT.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" trying to access non-existent file \"C:\\MSASN1.dll\"\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.dll\"\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" writes file \"c:\\windows\\system32\\mrt.exe\"\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" writes file \"%windir%\\system32\\mrt.exe\"\n \"MRT.exe\" writes file \"c:\\windows\\debug\\mrt.log\"\n \"MRT.exe\" writes file \"c:\\windows\\system32\\mrt\\42f64b14-d154-3b21-1ec6-042e0e0feaf6\\mpgear.dll\"\n \"MRT.exe\" writes file \"c:\\windows\\system32\\mrt\\42f64b14-d154-3b21-1ec6-042e0e0feaf6\\mpengine.dll\"\n \"MRT.exe\" writes file \"c:\\windows\\system32\\mrt\\42f64b14-d154-3b21-1ec6-042e0e0feaf6\\mrt\\01356dca-1a95-41fa-b75c-b980ff606b51\\mpgearsupport_20261110_10300196f817a1-29c7-576d-8d76-30d193ee333f.log\"\n \"MRT.exe\" writes file \"%windir%\\system32\\mrt\\42f64b14-d154-3b21-1ec6-042e0e0feaf6\\mpgear.dll\"\n \"MRT.exe\" writes file \"%windir%\\system32\\mrt\\42f64b14-d154-3b21-1ec6-042e0e0feaf6\\mpengine.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"MRT.exe\" writes a file \"C:\\Windows\\debug\\mrt.log\"\n \"MRT.exe\" writes a file \"C:\\Windows\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\\MpGearSupport_20261110_10300196F817A1-29C7-576D-8D76-30D193EE333F.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"Found string \"ping 127.0.0.1 & del \"\" (Indicator: \"ping 127\"; Source: \"00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp\n 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Able to hide C2 connections by leveraging external proxy routing","description":"Found string \"c:\\adober.exec:\\bittorrent.exe\" (Indicator: \"bittorrent.exe\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-719","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"$55","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: MPGEAR.DLL]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"ping 127.0.0.1 & del \"\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00003660.00000000.127913.1FCD0000.00000004.mdmp\n 00000000-00003660.00000001.129833.1FCD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"Services HotSenha possui tamanho invWindows Live Messengerhttp://mail.terra.com.brgoogle.com/accounts/ServiceLogin?service=mailWSASetServiceWWSARecvExTWebBrowserDocumentCompleteOnDownloadComplete\" (Indicator: \"WSARecv\"; Source: \"00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"terminateprocessGetUserObjectInformationAGetProcessWindowStationgetlastactivepopupHttpOpenRequestinternetcrackurla\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Found string \"ipconfig /renew\" (Indicator: \"ipconfig \"; Source: \"00000000-00003660.00000000.127913.1F350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$58","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer::worker, connection is closed\" (Indicator: \"SmtpServer\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://110.34.232.11:1314\"Found ip/domain with port number \"http://127.0.0.1:800\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"Found string \"libcurl.dll\" (Indicator: \"libcurl\"; Source: \"00000000-00003660.00000000.127913.1FBC0000.00000004.mdmp, 00000000-00003660.00000000.127913.27220000.00000004.mdmp, 00000000-00003660.00000001.129833.1FBC0000.00000004.mdmp, 00000000-00003660.00000001.129833.27240000.00000002.mdmp, 00000000-00003660.00000001.129833.28F60000.00000002.mdmp, 00000000-00003660.00000001.129833.31E40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"MRT.exe\"\n YARA signature for Djb2 Hash Algorithm matched on file \"MPENGINE.DLL\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Embedded PDF document","description":"YARA signature for embedded PDF matched on process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":1,"id":"yara-33","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"MRT.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible payload download using Office macros","description":"YARA signature for payload download using Office macros matched on process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1204.002","relevance":5,"id":"yara-28","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00003660\"\n YARA signature matched on embedded PE in file \"MRT.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"MRT.exe\"\n YARA signature for encryption algorithm process \"00000000-00003660\"\n YARA signature for encryption algorithm file \"MPGEAR.DLL\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"SHELL32.DLL.ASLR.ncacn_ip_tcp:%sContext=\"%s\">%SystemRoot%\\inf\\*.pnf\" (Indicator: \"ncacn_ip_tcp\"; Source: \"00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"WinScp\" (Indicator: \"winscp\"; Source: \"00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberos_bho.dll\" (Indicator: \"kerberos\"; Source: \"00000000-00003660.00000000.127913.1FCF0000.00000004.mdmp, 00000000-00003660.00000001.129833.1FCF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"findfirsturlcacheentryaGetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MPGEAR.DLL]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00003660.00000000.127913.1F350000.00000004.mdmp, 00000000-00003660.00000001.129833.2F760000.00000002.mdmp, 00000000-00003660.00000001.129833.2F850000.00000002.mdmp, 00000000-00003660.00000001.129833.2F950000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30390000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"findfirsturlcacheentryaGetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")\n Found reference to API \"${sysGetLogicalDriveStrings}(1024, r1)\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"MRT.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\system32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\\RebootActions\\* (UID: 00000000-00003660)\n \"MRT.exe\" called \"FindNextFileW\" with parameter 42F64B14-D154-3B21-1EC6-042E0E0FEAF6 (UID: 00000000-00003660)\n \"MRT.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00003660)\n \"MRT.exe\" called \"FindNextFileW\" with parameter 01356DCA-1A95-41FA-B75C-B980FF606B51 (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"MRT.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MRT.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"MRT.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$60","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"MRT.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$61","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"a -y -ep -IBCKcmd /c tasklist&&delautorun.inf\" [Source: 00000000-00003660.00000000.127913.1FCC0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query sqlite firefox history","description":"Found string \"bearshare\\shared\\kespersky keys generator.exeeautorun.infselect * from moz_loginsM\" (Indicator: \"select <> from moz_\"; Source: \"00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1217","relevance":1,"id":"string-464","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00003660.00000000.127913.1F350000.00000004.mdmp, 00000000-00003660.00000001.129833.2F760000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30390000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"$63","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$64","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Video ActiveX Object\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp\n 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[backspace]ctrl_alt_del_getkeywinsta0\" (Indicator: \"[BACKSPACE]\"; Source: \"00000000-00003660.00000000.127913.1D820000.00000004.mdmp\")\n Found string \"VPassive Mode (127,0,0,1,%d,%d)TPigeonService[PageDown]Pigeon_VIP_TVideoCapPXF2000.vicp.net:8080Windows_rejoice\" (Indicator: \"[Pagedown]\"; Source: \"00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp\")\n Found string \"-c[BACKSPACE]\\keylog.dat\" (Indicator: \"[BACKSPACE]\"; Source: \"00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$65","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"echo user_pref(\"network.proxy.type\", 2); >>prefs.jswinmgmts:{impersonationlevel=impersonate}!\\\\.\\root\\securitycenterselect * from antivirusproduct===================\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp\")\n Found string \"SELECT * FROM AntiVirusProductROOT\\SecurityCenter2i\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00003660.00000000.127913.1F200000.00000004.mdmp, 00000000-00003660.00000001.129833.1F200000.00000002.mdmp\")\n Found string \"inmgmts:\\\\localhost\\root\\cimv2SELECT * FROM Win32_OperatingSystemTFORM1\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00003660.00000000.127913.1F330000.00000004.mdmp, 00000000-00003660.00000001.129833.1F330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"$66","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"MRT.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: MPGEAR.DLL]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$67","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"$68","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\")\n Found reference to API \"'OnUnload calledDriverEntry calledRSDS:ZwDeleteFile\\\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"ReadProcessMemorySetWindowsHookExAInternetOpenUrlAforthgoergameclient.exesoul.exe\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003660.00000000.127913.1F1D0000.00000004.mdmp\n 00000000-00003660.00000000.127913.26730000.00000004.mdmp\n 00000000-00003660.00000001.129833.1F1D0000.00000002.mdmp\n 00000000-00003660.00000001.129833.28A90000.00000002.mdmp\n 00000000-00003660.00000001.129833.2A2C0000.00000002.mdmp\n 00000000-00003660.00000001.129833.2D7B0000.00000002.mdmp\n 00000000-00003660.00000001.129833.30110000.00000002.mdmp\n 00000000-00003660.00000001.129833.30160000.00000002.mdmp\n 00000000-00003660.00000001.129833.31480000.00000002.mdmp\n 00000000-00003660.00000001.129833.31D70000.00000002.mdmp\n 00000000-00003660.00000001.129833.31DC0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop sharedaccess.txt*.mbox*.wab*.mbx*.eml*.tbb3\" (Indicator: \"net stop\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00003660.00000000.127913.1D560000.00000004.mdmp, 00000000-00003660.00000000.127913.26700000.00000004.mdmp, 00000000-00003660.00000001.129833.26710000.00000002.mdmp, 00000000-00003660.00000001.129833.32250000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Deletes registry keys","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\REMOVALTOOLS\\MRT\"; Key: \"SENDFULLPACKAGE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"$69","origin":"File/Memory","mitre_attack_id":"T1685","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: MPGEAR.DLL]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" opened \"\\Device\\KsecDD\"\n \"MRT.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,svchost.exe,avp.exe,services.exe,winlogon.exe\" (Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000000.127913.27610000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.27150000.00000002.mdmp, 00000000-00003660.00000001.129833.27490000.00000002.mdmp, 00000000-00003660.00000001.129833.27530000.00000002.mdmp, 00000000-00003660.00000001.129833.27710000.00000004.mdmp, 00000000-00003660.00000001.129833.29EB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp, 00000000-00003660.00000001.129833.31BB0000.00000002.mdmp, 00000000-00003660.00000001.129833.31C10000.00000002.mdmp, 00000000-00003660.00000001.129833.31C30000.00000002.mdmp, 00000000-00003660.00000001.129833.31C80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp, 00000000-00003660.00000001.129833.28DF0000.00000002.mdmp, 00000000-00003660.00000001.129833.2C830000.00000002.mdmp, 00000000-00003660.00000001.129833.2EDB0000.00000002.mdmp, 00000000-00003660.00000001.129833.2F950000.00000002.mdmp, 00000000-00003660.00000001.129833.2FEC0000.00000002.mdmp, 00000000-00003660.00000001.129833.30410000.00000002.mdmp, 00000000-00003660.00000001.129833.30BE0000.00000002.mdmp\")\n Found reference to API \"*Dropper*!main : CreateMutex->ERROR_ALREADY_EXISTS\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003660.00000000.127913.1F1F0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"XPlgLoaderXPlugKeyLogger\\shellcode\\shellcode\\XPlug\\\" (Indicator: \"shellcode\"; Source: \"00000000-00003660.00000000.127913.1F350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"$6b","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Sample/File contains another embedded binary","description":"Found multiple string (Indicator: This program cannot be run in DOS mode) in file %WINDIR%\\System32\\MRT.exe at offset 964922","origin":"Binary File","mitre_attack_id":"T1027.009","relevance":3,"id":"binary-64","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"pstorec.dll\"; Source: \"00000000-00003660.00000000.127913.1F140000.00000004.mdmp, 00000000-00003660.00000001.129833.1F140000.00000002.mdmp\")\n Found string \"suid=%s&was=%d&left=%d&sent=%d&realsent=%d&dropname=%s&bankname=%s&url=%s&datetime=%s/getzalivi.phphttp://%s%s?search=%staskmgr.exepstorec.dllpstorecreateinstance\" (Indicator: \"pstorec.dll\"; Source: \"00000000-00003660.00000000.127913.1F1E0000.00000004.mdmp, 00000000-00003660.00000001.129833.1F1E0000.00000002.mdmp\")\n Found string \"ollydbg.exe\" (Indicator: \"ollydbg\"; Source: \"00000000-00003660.00000000.127913.1F340000.00000004.mdmp, 00000000-00003660.00000001.129833.1F340000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$6d","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MRT.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections\"- Location: [%WINDIR%\\System32\\MRT.exe]- [targetUID: 00000000-00002768]\n \"MPENGINE.DLL\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPENGINE.DLL]- [targetUID: 00000000-00003660]\n \"MPGEAR.DLL\" has type \"PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections\"- Location: [%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPGEAR.DLL]- [targetUID: 00000000-00003660]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$6e","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\MRT.exe\" (Handle: 432)\n \"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\MRT.exe\" (Handle: 432)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"System Destruction","name":"Possibly checks for the presence of an adware detecting tool","description":"\"BullGuard.exe\" (Indicator: \"bullguard.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-46","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1686","relevance":1,"id":"string-676","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$70","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n RegCreateKeyExW\n GetModuleHandleExW\n GetModuleHandleW\n GetFileSizeEx\n GetStartupInfoW\n CreateProcessW\n CreateFileW\n GetTempPathW\n CreateThreadpool\n GetNativeSystemInfo\n CreateThreadpoolWork\n LoadLibraryExA\n VirtualProtect\n UnhandledExceptionFilter\n DeleteFileW\n CreateDirectoryW\n GetCommandLineA\n LoadLibraryExW\n OutputDebugStringW\n GetSystemInfo\n FindFirstFileExW\n WriteFile\n GetProcAddress\n GetCommandLineW\n FindNextFileW\n IsDebuggerPresent\n GetFileAttributesW\n GetTickCount\n SleepConditionVariableSRW\n GetSystemDirectoryW\n GetFileAttributesExW\n GetComputerNameExW\n CopyFileW\n TerminateProcess\n Sleep\n GetModuleFileNameW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"malicious","category":"Cryptographic Related","name":"Found encryption keys in memory dumps","description":"Found encryption key \"1b1440d90fc9bcb46a9ac96438feea8b\" - Source: \"00000000-00003660.00000001.129833.26380000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1027","relevance":10,"id":"memorydump-0","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections\" was dropped at \"%WINDIR%\\System32\\MRT.exe\"\n File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\" was dropped at \"%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPENGINE.DLL\"\n File type \"PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections\" was dropped at \"%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPGEAR.DLL\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$71","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Base64-encoded PE executable within PE executable","description":"YARA signature for Base64-encoded PE executable within a PE executable matched on process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":9,"id":"yara-59","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - China Chopper web shell","description":"YARA signature to detect China Chopper web shell activity in process \"00000000-00003660\"","origin":"YARA Signature","mitre_attack_id":"T1505.003","relevance":10,"id":"yara-547","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"MRT.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00003660)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"fonts\\Elephant.exec:\\boot.inic:\\ntldr\" (Indicator: \"ntldr\")","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]}],"intel_graph":{"map":{"File:06751c639a6500d2a59b756981a217b6b0d0022d22ccc6f9847e0835c7772f05":{"type":"File","value":"06751c639a6500d2a59b756981a217b6b0d0022d22ccc6f9847e0835c7772f05"},"File:291bfa0b053d0934d64dcce4c1835afb03bdd260b7970cf4f50eb033b3c1cb06":{"type":"File","value":"291bfa0b053d0934d64dcce4c1835afb03bdd260b7970cf4f50eb033b3c1cb06","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/vnd.ms-cab-compressed"},"File:59850ec7fdb65d3f0aae0c56c82a1de988d59783c0f2bdd7a1489f5860394662":{"type":"File","value":"59850ec7fdb65d3f0aae0c56c82a1de988d59783c0f2bdd7a1489f5860394662"},"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705":{"type":"File","value":"79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Sample drops '.exe' file to system directory"]},"filetype":"PE32+ executable for MS Windows 6.01 (GUI), x86-64, 7 sections","filetype_short":"PE64"},"File:a3c2baaa0745625cbee7a6d0371b41f5e390bd9d4494867bea58c697a189bb7a":{"type":"File","value":"a3c2baaa0745625cbee7a6d0371b41f5e390bd9d4494867bea58c697a189bb7a"}},"chains":[{"id":"1569877044483468682","root":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Sample drops '.exe' file to system directory"]}},{"id":"1569877030892775322","root":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","to_key":"File:291bfa0b053d0934d64dcce4c1835afb03bdd260b7970cf4f50eb033b3c1cb06"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","edges":[{"edge_kind":"extracted","from_key":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","to_key":"File:59850ec7fdb65d3f0aae0c56c82a1de988d59783c0f2bdd7a1489f5860394662"},{"edge_kind":"extracted","from_key":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","to_key":"File:291bfa0b053d0934d64dcce4c1835afb03bdd260b7970cf4f50eb033b3c1cb06"},{"edge_kind":"extracted","from_key":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","to_key":"File:06751c639a6500d2a59b756981a217b6b0d0022d22ccc6f9847e0835c7772f05"},{"edge_kind":"extracted","from_key":"File:79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","to_key":"File:a3c2baaa0745625cbee7a6d0371b41f5e390bd9d4494867bea58c697a189bb7a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":60,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["uroburos","wabot","barium","irontwilight","venomousbear","naspy","carbon","webshell","adware","winntigroup","apt","rat","wcry","regsubdat","wannacry","banker","swallowtail","zeus","sekur","tg-4127","morpho","tsarteam","zeus1134","wickedspider","wildneutron","9002","uroboros","sofacy","sandworm","jrat","tailgater","happyyongzi","cvnx","pos","butterfly","xtreme","fireball","stuxnet","rescator","unit78020","xtunnel","waterbug","cycldek","strontium","pfinet","ragebeast","poisonivy","sakula","blackfly","lead","wraith","wickedpanda","krypton","hippoteam","sednit","apt17","cobra","group-4127","redapollo","terracota","apt19","nsfree","cerber","hellsing","apt10","sunshopgroup","platinum","tag_0700","c0d0so","ruag","deputydog","apt28","dogfish","easterjackpos","pwdump","sphinxmoth","turlagroup","codoso","twoforone","fancybear","group88","potassium","financial","nionspy","snake","gh0st","telebots","stonepanda","wanacrypt0r","fgdump","turla","group74","group72","pawnstorm","turlateam","goblinpanda","tailgaterteam","trickbot","plugx","duststorm","hacktool","ransomware","tag_0530","axiom","menupass","evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6af36224a5a502fc4e0c32fc","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"windows-kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe","analysis_start_time":"2026-11-10T18:28:00+00:00","indicators_count":{"informative":251,"suspicious":53,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}],"processes":[{"pid":2768,"ppid":0,"name":"kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe","command_line":"","sha256":"79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705","normalized_path":"%WINDIR%\\kb890830-x64-v5.147_363852203832b66685bd516c63595435b7ae1a8a.exe","uid":"00000000-00002768","icon":"$72"},{"pid":3660,"ppid":2768,"name":"MRT.exe","command_line":"","sha256":"2c97373ec6062510b687b25113a85274085dc8d7288676b19a45a2f8878b3c54","normalized_path":"%WINDIR%\\system32\\MRT.exe","parent_uid":"00000000-00002768","uid":"00000000-00003660"}],"all_imported_dlls":["userenv.dll","imagehlp.dll","msvcrt.dll","imm32.dll","crypt32.dll","VxSSL64.dll","ws2_32.dll","user32.dll","win32u.dll","comctl32.dll","MPENGINE.DLL","powrprof.dll","umpdc.dll","SHCore.dll","wintrust.dll","vcruntime140_1.dll","IPHLPAPI.DLL","WinTypes.dll","ntdll.dll","cryptbase.dll","bcrypt.dll","msasn1.dll","msvcp140.dll","winhttp.dll","tdh.dll","uxtheme.dll","wldp.dll","kernel32.dll","sechost.dll","rpcrt4.dll","bcryptprimitives.dll","nsi.dll","TextShaping.dll","ntmarta.dll","ucrtbase.dll","ole32.dll","shell32.dll","kernel.appcore.dll","MPGEAR.DLL","CoreMessaging.dll","KernelBase.dll","msctf.dll","gdi32.dll","gdi32full.dll","oleaut32.dll","gpapi.dll","CoreUIComponents.dll","advapi32.dll","fltLib.dll","shlwapi.dll","version.dll","rsaenh.dll","msvcp_win.dll","vcruntime140.dll","WofUtil.dll","TextInputFramework.dll","cryptsp.dll","combase.dll","cabinet.dll","dhcpcsvc.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"MPGEAR.DLL","sha256":"59850ec7fdb65d3f0aae0c56c82a1de988d59783c0f2bdd7a1489f5860394662","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"291bfa0b053d0934d64dcce4c1835afb03bdd260b7970cf4f50eb033b3c1cb06","sha256":"291bfa0b053d0934d64dcce4c1835afb03bdd260b7970cf4f50eb033b3c1cb06","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MRT.exe","sha256":"06751c639a6500d2a59b756981a217b6b0d0022d22ccc6f9847e0835c7772f05","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"MPENGINE.DLL","sha256":"a3c2baaa0745625cbee7a6d0371b41f5e390bd9d4494867bea58c697a189bb7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\System32\\MRT.exe","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\debug\\mrt.log","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPGEAR.DLL","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MPENGINE.DLL","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\System32\\MRT\\42F64B14-D154-3B21-1EC6-042E0E0FEAF6\\MRT\\01356DCA-1A95-41FA-B75C-B980FF606B51\\MpGearSupport_20261110_10300196F817A1-29C7-576D-8D76-30D193EE333F.log","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\REMOVALTOOLS\\MRT\\SENDFULLPACKAGE\\SENDFULLPACKAGE","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"SM0:2768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"Local\\SM0:2768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3660:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"SM0:3660:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"Local\\SM0:3660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]},{"name":"SM0:3660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af36224a5a502fc4e0c32fc"}]}]}},"report_ids":{"sandbox_job_ids":["6af36224a5a502fc4e0c32fc"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample 79bfa4539edc… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 79bfa4539edc…. Threat score 70/100. 0/26 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 79bfa4539edc… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 79bfa4539edc…. Threat score 70/100. 0/26 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/79bfa4539edcff4ae375ce9c9d81ab1525b3aca7506df8d020f21df72fe88705"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 79bfa4539edc… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 79bfa4539edc…. Threat score 70/100. 0/26 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]] 32:null