24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.HiddenTears.Generic Sample 7bf5623f0a10… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7bf5623f0a10…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a","keywords":["Malicious","Ransom.HiddenTears.Generic","malware analysis","sandbox report","threat intelligence","7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a"],"about":{"@type":"SoftwareApplication","name":"rensenware.vir","applicationCategory":["peexe","assembly","executable"],"identifier":"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.HiddenTears.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T67a,".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" ".exe" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" ".exe" touched file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index23c.dat" ".exe" touched file "%WINDIR%\system32\l_intl.nls" ".exe" touched file "%WINDIR%\assembly\pubpol47.dat" ".exe" touched file "%WINDIR%\system32\rsaenh.dll" ".exe" touched file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp"26:T76c,"Rensenware.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000098e32f01000000001800000000000000c2a5cc30c69d00001f785001000000000d0000000000000030e32f0100000000a0534f010000000060755001000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000e9a3fc7f00003b1346a7d9fb0000e046e9a3fc7f000020785001000000009806eaa3fc7f0000a0835001000000000000fba2fc7f00000000000000000000e046e9a3fc7f00000300000000000000f38537a5fc7f00006e47e9a3fc7f0000276637a5fc7f000070e32f01 (UID: 00000000-00006008) "Rensenware.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006008) "Rensenware.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006008)27:T1b8f,"Rensenware.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006008) "Rensenware.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006008)28:T513,"Rensenware.exe" loaded module "KERNEL32" at base 7ffca3fd0000 "Rensenware.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffca2770000 "Rensenware.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffca2770000 "Rensenware.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffca2770000 "Rensenware.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffca52d0000 "Rensenware.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffca2770000 "Rensenware.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffca2770000 "Rensenware.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffca2770000 "Rensenware.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc81350000 "Rensenware.exe" loaded module "ADVAPI32.DLL" at base 7ffca35d0000 "Rensenware.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc81180000 "Rensenware.exe" loaded module "SHLWAPI.DLL" at base 7ffca46d0000 "Rensenware.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffca17c0000 "Rensenware.exe" loaded module "VERSION.DLL" at base 7ffc98820000 "Rensenware.exe" loaded module "NTDLL.DLL" at base 7ffca5350000 "Rensenware.exe" loaded module "KERNELBASE" at base 7ffca277000029:T67b,"Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Rensenware.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "")2a:Tb95,"Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "Rensenware.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "")2b:T434,"Rensenware.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "Rensenware.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "Rensenware.exe" trying to touch file "C:\Rensenware.exe" "Rensenware.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "Rensenware.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "Rensenware.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "Rensenware.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "Rensenware.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "Rensenware.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "Rensenware.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "Rensenware.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "Rensenware.exe" trying to touch file "C:\Windows\System32\imm32.dll" "Rensenware.exe" trying to touch file "C:\CRYPTSP.DLL" "Rensenware.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "Rensenware.exe" trying to touch file "C:\Windows\System32\cryptsp.dll"2c:T461,"OpenProcess" (Indicator: "OpenProcess") "set_Multiselect" (Indicator: "select") "ReadProcessMemory" (Indicator: "ReadProcessMemory") "Sleep" (Indicator: "Sleep") "sender" (Indicator: "send") "C:\Users\btbwqvh\AppData\Roaming\Mozilla\Firefox\Profiles\fg6ygf16.default\gmp-gmpopenh264\*" (Indicator: "open") "C:\Users\btbwqvh\AppData\Roaming\Mozilla\Firefox\Profiles\fg6ygf16.default\gmp-gmpopenh264\*.*" (Indicator: "open") "C:\Users\btbwqvh\AppData\Roaming\Mozilla\Firefox\Profiles\fg6ygf16.default\gmp-gmpopenh264\1.7.1\*" (Indicator: "open") "C:\Users\btbwqvh\AppData\Roaming\Mozilla\Firefox\Profiles\fg6ygf16.default\gmp-gmpopenh264\1.7.1\*.*" (Indicator: "open") "C:\Users\btbwqvh\AppData\Roaming\Macromedia\Flash Player\openssl\*" (Indicator: "open") "C:\Users\btbwqvh\AppData\Roaming\Macromedia\Flash Player\openssl\*.*" (Indicator: "open") "C:\Users\btbwqvh\AppData\Roaming\Macromedia\Flash Player\openssl\cache\*" (Indicator: "open") "C:\Users\btbwqvh\AppData\Roaming\Macromedia\Flash Player\openssl\cache\*.*" (Indicator: "open") "ThemeApiConnectionRequest" (Indicator: "ThemeApiConnectionRequest")2d:T566,"rensenware.vir.exe" trying to access non-existent file "C:\FLTLIB.DLL" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "rensenware.vir.exe" trying to access non-existent file "C:\rensenware.vir.exe.Local\" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fusion.localgac" "rensenware.vir.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "rensenware.vir.exe" trying to access non-existent file "C:\rensenware.vir.config" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\Globalization\en-us.nlp" "rensenware.vir.exe" trying to access non-existent file "C:\shfolder.dll" "rensenware.vir.exe" trying to access non-existent file "C:\CRYPTSP.dll" "rensenware.vir.exe" trying to access non-existent file "C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll"2e:T6c8,"rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\6x7ogLEUua7P0r.gif" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\7apDTq.jpg" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\9kzZfe.jpg" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\9ld3Swg9d708.avi" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\Ae5I9Tp.doc" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\aV63jolkZYRS.gif" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\B1quCrDurbd4XKkA.mp3" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\b351j5J.doc" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\b83j1whH4AFW.jpg" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\bi15sDCCo6KP.mp3" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\bMTL7.doc" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\bmwV9wV922aP.rar" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\BvPHO2whvH.jpg" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\BwGP.mp3" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\c6U0diDPlb.pdf" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\CXTZW9A2KnJ.rar" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\D5XQTXC52pXqq.mp3" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\dADsR8ADZA.avi" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\DPYao.gif" for deletion "rensenware.vir.exe" marked "C:\Users\%OSUSER%\Downloads\dS50hM5BYSkIp3.pdf" for deletion2f:T740,"rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\6x7ogLEUua7P0r.gif" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\7apDTq.jpg" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\9kzZfe.jpg" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\9ld3Swg9d708.avi" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\Ae5I9Tp.doc" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\aV63jolkZYRS.gif" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\B1quCrDurbd4XKkA.mp3" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\b351j5J.doc" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\b83j1whH4AFW.jpg" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\bi15sDCCo6KP.mp3" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\bMTL7.doc" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\bmwV9wV922aP.rar" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\BvPHO2whvH.jpg" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\BwGP.mp3" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\c6U0diDPlb.pdf" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\CXTZW9A2KnJ.rar" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\D5XQTXC52pXqq.mp3" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\dADsR8ADZA.avi" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\DPYao.gif" with delete access "rensenware.vir.exe" opened "C:\Users\%OSUSER%\Downloads\dS50hM5BYSkIp3.pdf" with delete access30:T9e8,"rensenware.vir.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE11755E" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "e9d240ecff" to virtual address "0x776DC63C" ("GetAsyncKeyState@USER32.DLL") "rensenware.vir.exe" wrote bytes "669065488b0425e0140000c366669066669090" to virtual address "0xEE115B40" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xEE115BC0" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE117480" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "4889114881fab043b902722448c1e90a80b98052b61aff7502f3c3c6818052b61affc366666690666666906666906690f3c3ff7502f3c3c60408ffc366666690f3c3666666906666669066669066669090" to virtual address "0xEE115F00" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE117403" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEE117A44" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "e9fee02800" to virtual address "0xFD882D50" ("CreateCompatibleBitmap@GDI32.DLL") "rensenware.vir.exe" wrote bytes "2ed0799b002f0000" to virtual address "0xEDEA1D70" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE118C0B" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE118C4B" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE118C8B" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEE118CCB" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE11760D" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE1175B3" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE1174FB" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEE11863C" (part of module "MSCORWKS.DLL") "rensenware.vir.exe" wrote bytes "e94eb7ebff" to virtual address "0x776E4F80" ("GetKeyState@USER32.DLL") "rensenware.vir.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEE11743F" (part of module "MSCORWKS.DLL")31:Ta3e,"04756899.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000770069006e007300780073005c0061006d006400360034005f006d006900630072006f0073006f00660074002e0076006300380030002e006300720074005f0031006600630038006200330062003900610031006500310038006500330062005f0038002e0030002e00350030003700320037002e003900330034003800 (UID: 00000000-00006188) "04756899.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000003a9a46b1b1e100000400000000000000ffffffffffffffff2400000000000000d6007244fa7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff (UID: 00000000-00006188) "04756899.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006188) "04756899.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f0030b0a302000000000100000003000000010000006600740018000000450054000000000000000000000000000000000001000000360034000100000032002e0000000000000000000000000037005c0063006f0000000000000000000000000000000000010000002f00000000000000000000006600690067000000 (UID: 00000000-00006188) "04756899.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000003808063ffa7f0000020000000000000000000000000000000000043ffa7f00003808063ffa7f0000000000000000000000000000000000008b20123ffa7f000000000000000000000000000000000000000000000000000064c379000000000000000000 (UID: 00000000-00006188) "dw20.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000530059005300540045004d00330032005c006d00730063006f007200650065002e0064006c006c00000072006b00360034005c00760032002e0030002e00350030003700320037005c006d00730063006f007200650065002e0064006c006c000000060000062d8500007066330300000000c04b33030000000035003600 (UID: 00000000-00003012) "dw20.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000010000000000000010d3130500000000e0d213050000000028d31305000000002e835b977f1b0000fed371ef8924000000000000000000000000000000000000281e8505 (UID: 00000000-00003012)32:T2784,"04756899.exe" called "NtQueryInformationToken" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenKeyEx" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryValueKey" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryInformationFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtEnumerateValueKey" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtProtectVirtualMemory" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenThread" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtResumeThread" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryAttributesFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtCreateSection" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtMapViewOfSection" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryVolumeInformationFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtRequestWaitReplyPort" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenSection" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtAllocateVirtualMemory" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtSetInformationProcess" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "LdrLoadDll" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryInformationProcess" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQuerySystemInformation" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtUnmapViewOfSection" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "LdrGetDllHandle" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtDeviceIoControlFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryKey" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtSetInformationKey" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtCreateEvent" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtNotifyChangeKey" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenThreadToken" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenEvent" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenProcessToken" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "LoadLibrary" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryVirtualMemory" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtSuspendThread" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtGetContextThread" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "GetProcAddress" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtEnumerateKey" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "LdrUnloadDll" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtCreateMutant" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenProcess" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryDefaultLocale" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "GetVersionExA" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtReadFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtCreateThreadEx" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtCreateFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtCreateKeyEx" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtOpenMutant" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtConnectPort" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtSetInformationThread" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQuerySystemTime" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "CryptAcquireContextW" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtWaitForMultipleObjects" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtWriteFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtSetInformationFile" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtCreateUserProcess" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtQueryLicenseValue" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtWriteVirtualMemory" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "NtTerminateProcess" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "RtlGetVersion" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "RtlGetNtProductType" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "FindFirstFileW" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "FindNextFileW" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "IsWow64Process" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "CreateToolhelp32Snapshot" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "GetDriveTypeW" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "GetLocaleInfoW" (PID: 6188) (UID: 00000000-00006188) "04756899.exe" called "CreateProcessW" (PID: 6188) (UID: 00000000-00006188) "dw20.exe" called "NtQueryInformationToken" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenKeyEx" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryValueKey" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryKey" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtSetInformationKey" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtEnumerateValueKey" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtProtectVirtualMemory" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenThread" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtResumeThread" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryAttributesFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtCreateSection" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryVolumeInformationFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtRequestWaitReplyPort" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenSection" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtSetInformationProcess" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQuerySystemInformation" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryInformationProcess" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtAllocateVirtualMemory" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "LdrLoadDll" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "LoadLibrary" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryVirtualMemory" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "GetProcAddress" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtCreateThreadEx" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "LdrGetDllHandle" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtReadVirtualMemory" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryInformationFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtMapViewOfSection" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenProcessToken" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtCreateEvent" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenDirectoryObject" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenThreadToken" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtDeviceIoControlFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "LdrUnloadDll" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtAdjustPrivilegesToken" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtLoadKeyEx" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtCreateKeyEx" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtSetValueKey" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtDeleteKey" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtUnmapViewOfSection" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtCreateMutant" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtEnumerateKey" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryLicenseValue" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtCreateFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtSetInformationFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtPowerInformation" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenProcess" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtSuspendThread" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtGetContextThread" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryDefaultLocale" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "GetVersionExA" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtWriteFile" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtQueryObject" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtOpenEvent" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtAlpcConnectPort" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtAlpcSendWaitReceivePort" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtSetInformationThread" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtWaitForMultipleObjects" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "NtTerminateProcess" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "RtlGetNtProductType" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "RtlGetVersion" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "CreateToolhelp32Snapshot" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "FindResourceA" (PID: 3012) (UID: 00000000-00003012) "dw20.exe" called "LoadResource" (PID: 3012) (UID: 00000000-00003012)33:Ta02,"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\*") in Source: 00000000-00006188-00000C27-9937364229 "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\*.*") in Source: 00000000-00006188-00000C27-9941855395 "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\desktop\..\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\*") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.*" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\*.*") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\desktop\..\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\getminidump.bat" (Indicator: "c:\users\hapubws\desktop\..\appdata\roaming\microsoft\windows\start menu\programs\startup\getminidump.bat") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk" (Indicator: "c:\users\hapubws\desktop\..\appdata\roaming\microsoft\windows\start menu\programs\startup\onenote 2010 screen clipper and launcher.lnk") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\." (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\.") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp34:T5a1,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006188.00000000.78099.FEFA0000.00000002.mdmp35:T1e9d,"04756899.exe" loaded module "C:\04756899.exe" at 00640000 "04756899.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 4EB50000 "04756899.exe" loaded module "%WINDIR%\System32\mscoree.dll" at 44370000 "04756899.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 4E060000 "04756899.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 4AFF0000 "04756899.exe" loaded module "%WINDIR%\System32\apphelp.dll" at 492A0000 "04756899.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at 44710000 "04756899.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 4E570000 "04756899.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 4DCD0000 "04756899.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 42DB0000 "04756899.exe" loaded module "%WINDIR%\System32\ucrtbase.dll" at 4BB50000 "04756899.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 44310000 "04756899.exe" loaded module "%WINDIR%\System32\user32.dll" at 4E110000 "04756899.exe" loaded module "%WINDIR%\System32\win32u.dll" at 4BCB0000 "04756899.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 4C170000 "04756899.exe" loaded module "%WINDIR%\System32\gdi32full.dll" at 4B9B0000 "04756899.exe" loaded module "%WINDIR%\System32\msvcp_win.dll" at 4AF50000 "04756899.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 4C1A0000 "04756899.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 4E8F0000 "04756899.exe" loaded module "%WINDIR%\System32\sechost.dll" at 4C830000 "04756899.exe" loaded module "%WINDIR%\System32\ole32.dll" at 4C020000 "04756899.exe" loaded module "%WINDIR%\System32\combase.dll" at 4E5E0000 "04756899.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 4BEA0000 "04756899.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 4DF70000 "04756899.exe" loaded module "%WINDIR%\System32\imm32.dll" at 4E300000 "04756899.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" at 43E50000 "04756899.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 4C2B0000 "04756899.exe" loaded module "%WINDIR%\System32\kernel.appcore.dll" at 4AF30000 "04756899.exe" loaded module "%WINDIR%\System32\version.dll" at 45FA0000 "04756899.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" at 2B820000 "04756899.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9348_none_88dedda92fafc8db\msvcr80.dll" at 6C710000 "04756899.exe" loaded module "%WINDIR%\System32\shell32.dll" at 4C890000 "04756899.exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at 4BF20000 "04756899.exe" loaded module "%WINDIR%\System32\SHCore.dll" at 4C770000 "04756899.exe" loaded module "%WINDIR%\System32\windows.storage.dll" at 4B260000 "04756899.exe" loaded module "%WINDIR%\System32\powrprof.dll" at 4AEC0000 "04756899.exe" loaded module "%WINDIR%\System32\profapi.dll" at 4AEA0000 "04756899.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\9833e30950e59154b7792b48938e4e97\mscorlib.ni.dll" at 2A940000 "04756899.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 49490000 "04756899.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll" at 3F040000 "04756899.exe" loaded module "%WINDIR%\System32\shfolder.dll" at 44660000 "04756899.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\System\893341977b084a7627561c147da39e0c\System.ni.dll" at 231D0000 "04756899.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Drawing\2c094d1b56df6b8c876057d130170612\System.Drawing.ni.dll" at 3AB50000 "04756899.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\58e2621ea621f062372147f12c6c27f1\System.Windows.Forms.ni.dll" at 22130000 "04756899.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 4A890000 "04756899.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 4A2E0000 "04756899.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 4A9A0000 "04756899.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 4A8B0000 "04756899.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\Culture.dll" at 44650000 "04756899.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\diasymreader.dll" at 3A840000 "dw20.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\dw20.exe" at 10000000 "dw20.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 4EB50000 "dw20.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 4E060000 "dw20.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 4AFF0000 "dw20.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 4C1A0000 "dw20.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 4E8F0000 "dw20.exe" loaded module "%WINDIR%\System32\sechost.dll" at 4C830000 "dw20.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 4DCD0000 "dw20.exe" loaded module "%WINDIR%\System32\user32.dll" at 4E110000 "dw20.exe" loaded module "%WINDIR%\System32\win32u.dll" at 4BCB0000 "dw20.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 4C170000 "dw20.exe" loaded module "%WINDIR%\System32\gdi32full.dll" at 4B9B0000 "dw20.exe" loaded module "%WINDIR%\System32\msvcp_win.dll" at 4AF50000 "dw20.exe" loaded module "%WINDIR%\System32\ucrtbase.dll" at 4BB50000 "dw20.exe" loaded module "%WINDIR%\System32\psapi.dll" at 4C310000 "dw20.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9348_none_88dedda92fafc8db\msvcr80.dll" at 6C710000 "dw20.exe" loaded module "%WINDIR%\System32\version.dll" at 45FA0000 "dw20.exe" loaded module "%WINDIR%\System32\imm32.dll" at 4E300000 "dw20.exe" loaded module "%WINDIR%\System32\combase.dll" at 4E5E0000 "dw20.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 4BEA0000 "dw20.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at 44710000 "dw20.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 4E570000 "dw20.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 42DB0000 "dw20.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 44310000 "dw20.exe" loaded module "%WINDIR%\System32\ole32.dll" at 4C020000 "dw20.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 4DF70000 "dw20.exe" loaded module "%WINDIR%\System32\wer.dll" at 495F0000 "dw20.exe" loaded module "%WINDIR%\System32\aepic.dll" at 411F0000 "dw20.exe" loaded module "%WINDIR%\System32\SHCore.dll" at 4C770000 "dw20.exe" loaded module "%WINDIR%\System32\ntmarta.dll" at 4A010000 "dw20.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 4A9A0000 "dw20.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 4A890000 "dw20.exe" loaded module "%WINDIR%\System32\sfc.dll" at 03810000 "dw20.exe" loaded module "%WINDIR%\System32\sfc_os.dll" at 442F0000 "dw20.exe" loaded module "%WINDIR%\System32\setupapi.dll" at 4C320000 "dw20.exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at 4BF20000 "dw20.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 4A2E0000 "dw20.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 4A8B0000 "dw20.exe" loaded module "%WINDIR%\System32\dbghelp.dll" at 241A0000 "dw20.exe" loaded module "%WINDIR%\System32\dbgcore.dll" at 2EDE0000 "dw20.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscordacwks.dll" at 2EF90000 "dw20.exe" loaded module "%WINDIR%\System32\mscoree.dll" at 44370000 "dw20.exe" loaded module "%WINDIR%\System32\windows.storage.dll" at 4B260000 "dw20.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 4C2B0000 "dw20.exe" loaded module "%WINDIR%\System32\kernel.appcore.dll" at 4AF30000 "dw20.exe" loaded module "%WINDIR%\System32\powrprof.dll" at 4AEC0000 "dw20.exe" loaded module "%WINDIR%\System32\profapi.dll" at 4AEA0000 "dw20.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll" at 3A86000036:T4c1,"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"37:T67d,"04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle64.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\IMM32.DLL"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\oleaut32.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ole32.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local" "$status": "c0000034"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\VERSION.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\04756899.exe.Local\\" "$status": "c0000034"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\WinSxS\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9348_none_88dedda92fafc8db\\MSVCR80.dll"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\fusion.localgac" "$status": "c0000034"} "04756899.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\Users\\%OSUSER%"}38:Tf73,"04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "276" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "344" "DesiredAccess": "8" "TokenHandle": "348" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "356" "DesiredAccess": "8" "TokenHandle": "364" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "364" "DesiredAccess": "8" "TokenHandle": "356" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "444" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "588" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "608" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "616" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "660" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "12" "TokenHandle": "764" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "764" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "708" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "2" "TokenHandle": "816" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "848" "$name": "C:\\04756899.exe"} "04756899.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "808" "$name": "C:\\04756899.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "280" "DesiredAccess": "11" "TokenHandle": "288" "$name": "C:\\04756899.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "300" "$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\dw20.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "40" "TokenHandle": "388" "$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\dw20.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "12" "TokenHandle": "472" "$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\dw20.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "472" "$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\dw20.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "416" "DesiredAccess": "8" "TokenHandle": "496" "$name": "C:\\04756899.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "416" "DesiredAccess": "8" "TokenHandle": "604" "$name": "C:\\04756899.exe"} "dw20.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "656" "$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\dw20.exe"}39:T40c,"04756899.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "04756899.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "0" "TokenHandle": "0" "$status": "c000007c"} "04756899.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "04756899.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "dw20.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} "dw20.exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"}3a:T9fc,Found reference to API "11634506979,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11647407830,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.296",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11645109104,4504,3111,,FindFirstFileW,kernel32.dll,"00:20:20.296",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11631688057,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11625874437,4504,3111,,FindFirstFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11639745499,4504,3111,,FindFirstFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11643617230,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.296",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11635436283,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11619548733,4504,3111,,FindFirstFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11640329667,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11637738715,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11613653558,4504,3113,,FindNextFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found reference to API "11623332978,4504,3111,,FindFirstFileW,kernel32.dll,"00:20:20.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp")3b:T86b,"%APPDATA%\Microsoft\Vault\*" (Indicator: "\microsoft\vault"; File: "00000000-00006188-00000C27-10214981922") "%APPDATA%\Microsoft\Vault\*.*" (Indicator: "\microsoft\vault"; File: "00000000-00006188-00000C27-10219163001") "%APPDATA%\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00006188-00000C27-11153806846") "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\*.*" (Indicator: "\microsoft\credentials"; File: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Vault" (Indicator: "\microsoft\vault"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Vault" (Indicator: "\microsoft\vault"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Vault\*" (Indicator: "\microsoft\vault"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Vault\*.*" (Indicator: "\microsoft\vault"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\*.*" (Indicator: "\microsoft\credentials"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Credentials\466BB687837BC5F9274E7EF69021FED2" (Indicator: "\microsoft\credentials"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Credentials\." (Indicator: "\microsoft\credentials"; File: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp")3c:T145d,Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\16\*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\User\Document Themes\1033\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\User\Document Themes\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\User\Word Document Building Blocks\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\1033\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\User\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.02A10000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Templates" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\LiveContent" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Templates\" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Templates\LiveContent" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Templates\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Templates\Normal.dotm" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Desktop\..\AppData\Roaming\Microsoft\Templates\NormalOld.dotm" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00006188.00000000.78099.04D20000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790308239939,"unified_at":"2026-09-25T03:50:39.939Z","metadata":{"hashes":{"sha256":"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a","sha1":"61f3e01174a6557f9c0bfc89ae682d37a7e91e2e","md5":"60335edf459643a87168da8ed74c2b60","sha512":"b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb","ssdeep":"3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx","ssdeep_chunks":["3072:kGXc7vE","3072:GXc7vE4","3072:Xc7vE4k","3072:c7vE4k8","3072:7vE4k8s","3072:vE4k8sW","3072:E4k8sWJ","3072:4k8sWJn","3072:k8sWJnm","3072:8sWJnmi","3072:sWJnmiW","3072:WJnmiWp","3072:JnmiWpJ","3072:nmiWpJt","3072:miWpJtC","3072:iWpJtCk","3072:WpJtCkG","3072:pJtCkGw","3072:JtCkGwJ","3072:tCkGwJ1","3072:CkGwJ1E","3072:kGwJ1ED","3072:GwJ1ED7","3072:wJ1ED7q","3072:J1ED7qz","3072:1ED7qzt","3072:ED7qztG","6144:kGXc7vE","6144:GXc7vE4","6144:Xc7vE4k","6144:c7vE4k8","6144:7vE4k8s","6144:vE4k8sW","6144:E4k8sWJ","6144:4k8sWJn","6144:k8sWJnm","6144:8sWJnmi","6144:sWJnmiW","6144:WJnmiWp","6144:JnmiWpJ","6144:nmiWpJt","6144:miWpJtC","6144:iWpJtCk","6144:WpJtCkG","6144:pJtCkGw","6144:JtCkGwJ","6144:tCkGwJ1","6144:CkGwJ1E","6144:kGwJ1ED","6144:GwJ1ED7","6144:wJ1ED7q","6144:J1ED7qz","6144:1ED7qzt","6144:ED7qztG","3072:RXD8sWB","3072:XD8sWBm","3072:D8sWBmi","3072:8sWBmiW","3072:sWBmiW0","3072:WBmiW0w","3072:BmiW0wX","3072:miW0wX6","3072:iW0wX6G","3072:W0wX6Gx"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"rensenware.vir","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":98816,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287280000,"last_seen":1773758200000,"last_multi_scan":1773758200000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["RensenWare","Spyware","Stealer","ransomware","crypt","cryptolocker","downloader","locker","rensen","hiddentear","windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":96,"suspicious_count":22,"malicious_count":9,"total":127},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1365606","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.HiddenTears.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-6237474-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_MSIL_Cryptolocker_PDL_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.HiddenTears.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Filecoder.RensenWare.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.HiddenTear.oa!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.Rensen.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005324731 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Rensen-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Ransomware-GVC!60335EDF4596","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRansom.ORYW-8764","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.HiddenTear.ATX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_53.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.4590","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.HiddenTears.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API during runtime"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains ability to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Tries to retrieve system manufacturer/productname details"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"suspicious","value":"Write many files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Persistence","technique":"Bootkit","attack_id":"T1542.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1542/003","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Persistence","technique":"Office Template Macros","attack_id":"T1137.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1137/001","identifiers":[{"type":"informative","value":"Contains reference to MS Word template folder"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Calls an API typically used to unmap view of a section from a process"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to delete Powershell session command history file"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Visual Studio 2017\\Projects\\renseiWare\\rensenWare\\obj\\Release\\rensenWare.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 6C7D0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"dH1rDN9f9.doc.RENSENWARE\" has type \"data\"\n \"klmqz.doc.RENSENWARE\" has type \"data\"\n \"3AVoUo9c20GI.pdf.RENSENWARE\" has type \"data\"\n \"GgPR9V5hPE8bUpO.jpg.RENSENWARE\" has type \"data\"\n \"86iRpMfVS9o.jpg.RENSENWARE\" has type \"data\"\n \"7ZOfXpturAqbd1c.avi.RENSENWARE\" has type \"data\"\n \"1N1A3vlRdYRii5C.mp3.RENSENWARE\" has type \"data\"\n \"rbfKgDSibNA52.rar.RENSENWARE\" has type \"data\"\n \"nptZgkCVl0OD.mp3.RENSENWARE\" has type \"data\"\n \"hCmeX1Ct3FFL6dk.jpg.RENSENWARE\" has type \"data\"\n \"b9UD.jpg.RENSENWARE\" has type \"data\"\n \"RTgAfRGNR0qKZtig.jpg.RENSENWARE\" has type \"data\"\n \"6MR6.mp3.RENSENWARE\" has type \"data\"\n \"aGAui.avi.RENSENWARE\" has type \"data\"\n \"Jm34QKUSbOJ.pdf.RENSENWARE\" has type \"data\"\n \"Mfc8nmRBfzSVE.txt.RENSENWARE\" has type \"data\"\n \"C04T72pR0Bcl.doc.RENSENWARE\" has type \"data\"\n \"EIy4cIf3Sw.pdf.RENSENWARE\" has type \"data\"\n \"hKY8.doc.RENSENWARE\" has type \"data\"\n \"acZ9pR3WMOxAcq.txt.RENSENWARE\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00043421-00002436-00000105-100815397","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.7530824745","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"15.0.1.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY PE EXE or DLL Windows file download HTTP\" (SID: 2018959, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/61 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/61 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"34/61 Antivirus vendors marked spawned process \".exe\" (PID: 2436) as malicious (classified as \"Ransom.HiddenTears.Generic\" with 55% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RijndaelManaged\" (Indicator: \"Rijndael\"; File: \"Rensenware.exe\")\n Found reference to \"RijndaelManaged\" (Indicator: \"RijndaelManaged\"; File: \"Rensenware.exe\")\n Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; File: \"Rensenware.exe\")\n Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; File: \"Rensenware.exe\")\n Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; File: \"Rensenware.exe\")\n Found reference to \"RNGCryptoServiceProvider\" (Indicator: \"RNGCryptoServiceProvider\"; File: \"Rensenware.exe\")\n Found reference to \"RandomNumberGenerator\" (Indicator: \"RandomNumberGenerator\"; File: \"Rensenware.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.688739956430199","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Rensenware.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006008)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"System.Environment::GetLogicalDrives() at 60335edf459643a87168da8ed74c2b60-600001c-Program~Main","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Rensenware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Rensenware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"rensenWare.frmWarning::OpenProcess(System.Int32,System.Boolean,System.Int32) at 60335edf459643a87168da8ed74c2b60-6000014-ctorb__8_0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Rensenware.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" - (UID: 00000000-00006008)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"Rensenware.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00006008)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"Sleep\"; File: \"Rensenware.exe\")\n Found reference to API (Indicator: \"GetLogicalDrives\"; File: \"Rensenware.exe\")\n Found reference to API (Indicator: \"OpenProcess\"; File: \"Rensenware.exe\")\n Found reference to API (Indicator: \"GetObject\"; File: \"Rensenware.exe\")\n Found reference to API (Indicator: \"MessageBox\"; File: \"Rensenware.exe\")\n Found reference to API (Indicator: \"ReadProcessMemory\"; File: \"Rensenware.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Rensenware.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6008:304:WilStaging_02\"\n \"Local\\SM0:6008:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"fondue.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A30D0000\n \"fondue.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A2050000\n \"OptionalFeatures.EXE\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A2050000\n \"OptionalFeatures.EXE\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A30D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Rensenware.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A5080000\n \"fondue.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A5080000\n \"OptionalFeatures.EXE\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A5080000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Rensenware.exe\" was detected as \".NET\" and name: \"Library\"\n \"Rensenware.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\fondue.exe\" [Source: 00000000-00006008-00000C44-2706557230]\n Observed system executable string:\"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" [Source: 00000000-00006008-00000C44-2706557230]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\Fondue.exe\" [Source: 00000000-00006008-00000BC0-3002135733]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00006008-00000C2B-2060319486]\n Observed system executable string:\"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" [Source: 00000000-00006008-00000C44-2706557230]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"fondue.exe\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00002956)\n Spawned process \"OptionalFeatures.EXE\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00001548)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"fondue.exe\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00002956)\n Spawned process \"OptionalFeatures.EXE\" with commandline \"/enable-feature:NetFx3 /caller-name:mscoreei.dll\" (UID: 00000000-00001548)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Rensenware.exe\" queries basic process information of the \"C:\\Rensenware.exe\" (UID: 6008)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"Rensenware.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Rensenware.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"Rensenware.exe\" trying to access non-existent file \"C:\\Rensenware.exe.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"!,.kw\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Rensenware.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"Rensenware.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Microsoft.NET\\Framework64\\\\* (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"FindNextFileW\" with parameter sbscmp10.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"FindNextFileW\" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"FindNextFileW\" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"FindNextFileW\" with parameter SharedReg12.dll (UID: 00000000-00006008)\n \"Rensenware.exe\" called \"FindNextFileW\" with parameter v4.0.30319 (UID: 00000000-00006008)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"RijndaelManaged\" (Indicator: \"rijndael\"; File: \"Rensenware.exe\")\n Found string \"RijndaelManaged\" (Indicator: \"Rijndaelmanaged\"; File: \"Rensenware.exe\")\n Found string \"CryptoStreamMode\" (Indicator: \"cryptostream\"; File: \"Rensenware.exe\")\n Found string \"CryptoStreamMode\" (Indicator: \"cryptostreammode\"; File: \"Rensenware.exe\")\n Found string \"CryptoStream\" (Indicator: \"cryptostream\"; File: \"Rensenware.exe\")\n Found string \"RNGCryptoServiceProvider\" (Indicator: \"rngcryptoserviceprovider\"; File: \"Rensenware.exe\")\n Found string \"CreateDecryptor\" (Indicator: \"createdecryptor\"; File: \"Rensenware.exe\")\n Found string \"CreateEncryptor\" (Indicator: \"createencryptor\"; File: \"Rensenware.exe\")\n Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; File: \"Rensenware.exe\")\n Found string \"sonaes\" (Indicator: \"aes\"; File: \"screen_0.png\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; File: \"Rensenware.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Rensenware.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\Fondue.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006008-00000BC0-3002135733\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"Rensenware.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\FONDUE.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"%WINDIR%\\system32\\fondue.exe\" (Indicator: \"fondue.exe\")\n \"\"%WINDIR%\\system32\\fondue.exe\" /enable-feature:NetFx3 /caller-name:mscoreei.dll\" (Indicator: \"fondue.exe\")\n \"\\Device\\HarddiskVolume3\\Windows\\System32\\Fondue.exe\" (Indicator: \"fondue.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"Rensenware.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex(System.Int32) at 60335edf459643a87168da8ed74c2b60-6000006-frmManualDecrypter~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at 60335edf459643a87168da8ed74c2b60-6000011-frmWarning~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at 60335edf459643a87168da8ed74c2b60-6000014-ctorb__8_0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Rensenware.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\Fondue.exe\" (Handle: 440)\n \"Rensenware.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\Fondue.exe\" (Handle: 440)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"dw20.exe\" called \"FindResourceA\" with parameter \"3945687512\" - (UID: 00000000-00002760)\n \"dw20.exe\" called \"FindResourceA\" with parameter \"4073155032\" - (UID: 00000000-00002760)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"dw20.exe\" called \"LoadResource\" (UID: 00000000-00002760)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"rensenware.vir.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002480)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"dw20.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"dw20.exe\" was created by \"rensenware.vir.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"dw20.exe\" called \"CopyFileW\" (UID: 00000000-00002760)\n \"dw20.exe\" called \"CopyFileW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_rensenware.vir.e_c883e76def2938e0db2bfebfe89d42a6be3c358 (UID: 00000000-00002760)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"rensenware.vir.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00002480)\n \"dw20.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_rensenware.vir.e_c883e76def2938e0db2bfebfe89d42a6be3c358 (UID: 00000000-00002760)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\"\n \"Software\\Microsoft\\RegEdt32\"\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts\"\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices\"\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TRUETYPE\"\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\EXTENSIONS\"\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\TWAIN\"\n \"SOFTWARE\\\\MICROSOFT\\\\CHARMAP\"\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS NT\\\\CURRENTVERSION\\\\NETWORK\\\\PERSISTENT CONNECTIONS\"\n \"SOFTWARE\\\\MICROSOFT\\\\WINDOWS HELP\"\n \"SOFTWARE\\\\MICROSOFT\\\\CLOCK\"\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$2c","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"rensenware.vir.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"dw20.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"rensenware.vir.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rensenware.vir.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"dw20.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"dw20.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"RijndaelManaged\" (Indicator: \"rijndaelmanaged\"; File: \"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin\")\n \"System.Security.Cryptography\" (Indicator: \"system.security.cryptography\"; File: \"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Oracle VM VirtualBox Guest Additions\\*\" (Indicator: \"virtualbox\")\n \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Oracle VM VirtualBox Guest Additions\\*.*\" (Indicator: \"virtualbox\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"screenshots@mozilla.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"dw20.exe\" wrote 4096 bytes starting with PE header signature to file \"%TEMP%\\WERAA7B.tmp.hdmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"dw20.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002760)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"dw20.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to retrieve system manufacturer/productname details","description":"\"dw20.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMPRODUCTNAME\")\n \"dw20.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMMANUFACTURER\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-115","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetAsyncKeyState@USER32.DLL\" in \"rensenware.vir.exe\"\n \"CreateCompatibleBitmap@GDI32.DLL\" in \"rensenware.vir.exe\"\n \"GetKeyState@USER32.DLL\" in \"rensenware.vir.exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \"rensenware.vir.exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \"rensenware.vir.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"rensenware.vir.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetLogicalDrives\" (Source: 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin, API is part of module: KERNELBASE.DLL)\n Found string \"OpenProcess\" (Source: 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin, API is part of module: KERNELBASE.DLL)\n Found string \"ReadProcessMemory\" (Source: 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$30","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delete Powershell session command history file","description":"\"C:\\Users\\HAPUBWS\\Desktop\\..\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt\" (Indicator: \"c:\\users\\hapubws\\desktop\\..\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt\") in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-244","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006188.00000000.78099.04D20000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006188.00000000.78099.04D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006188.00000000.78099.00640000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"04756899.exe\" called \"IsWow64Process\" (UID: 00000000-00006188)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"04756899.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00006188)\n \"04756899.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006188)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"3024,,RtlGetVersion,NTDLL.dll,\"00:20:16.703\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00006188.00000000.78099.02A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"dw20.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$33","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"04756899.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\ole32.dll\" - [base:0; Status:c0000135]\n \"04756899.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]\n \"04756899.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\VERSION.dll\" - [base:0; Status:c0000135]\n \"dw20.exe\" failed to load missing module \"phoneinfo.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\"04756899.exe\" loaded module \"C:\\04756899.exe\" at 00640000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$35","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$36","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"dw20.exe\" writes to a file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERA8AC.tmp.mdmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"04756899.exe\" allocated memory in \"C:\\04756899.exe\" with (Protection: \"read/write\")\n \"04756899.exe\" allocated memory in \"C:\\04756899.exe\" with (Protection: \"execute/read/write\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"04756899.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"dw20.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"WERBFDE.tmp.WERInternalMetadata.xml\" has type \"XML 1.0 document Little-endian UTF-16 Unicode text with CRLF line terminators\" - Location: [%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\WERBFDE.tmp.WERInternalMetadata.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"04756899.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config\"\n \"04756899.exe\" reads file \"c:\\users\\%osuser%\\downloads\\npp.8.4.7.portable.x64.zip\"\n \"04756899.exe\" reads file \"c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\"\n \"04756899.exe\" reads file \"c:\\04756899.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"04756899.exe\" writes file \"c:\\users\\%osuser%\\downloads\\npp.8.4.7.portable.x64.zip.rensenware\"\n \"dw20.exe\" writes file \"c:\\programdata\\microsoft\\windows\\wer\\temp\\wera8ac.tmp.mdmp\"\n \"dw20.exe\" writes file \"c:\\programdata\\microsoft\\windows\\wer\\temp\\werbfde.tmp.werinternalmetadata.xml\"\n \"dw20.exe\" writes file \"%allusersprofile%\\microsoft\\windows\\wer\\temp\\wera8ac.tmp.mdmp\"\n \"dw20.exe\" writes file \"%allusersprofile%\\microsoft\\windows\\wer\\temp\\werbfde.tmp.werinternalmetadata.xml\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"$38","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"$39","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"3024,,RtlGetVersion,NTDLL.dll,\"00:20:16.703\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006188.00000000.78099.02A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006188-00000C27-13773958966\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*.*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006188-00000C27-13776859570\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Outlook\\*\" in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Outlook\\*.*\" in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\Desktop\\..\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml\" in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Outlook\\.\" in Source: 00000000-00006188.00000000.78099.04D20000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00006188.00000000.78099.04D20000.00000004.mdmp\")\n Found string \"C:\\Users\\HAPUBWS\\Desktop\\..\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00006188.00000000.78099.04D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to unmap view of a section from a process","description":"\"04756899.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"2c10000\"}\n \"04756899.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"2c50000\"}\n \"04756899.exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"BaseAddress\": \"2c20000\"}","origin":"API Call","mitre_attack_id":"T1055.012","relevance":1,"id":"api-261","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to MS Word template folder","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1137.001","relevance":1,"id":"string-440","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"04756899.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006188)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Write many files with double extensions (often indicator of ransomware infection)","description":"\"dw20.exe\" write more than 100 files with extension \".tmp.mdmp\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"dw20.exe\" at 00000000-00003012-00000C13-90642556\n \"dw20.exe\" at 00000000-00003012-00000C13-90643098","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"dw20.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","origin":"API Call","mitre_attack_id":"T1542.003","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":118,"dropped_files_count":0,"extracted_files_count":42,"files_written_count":210,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["RensenWare","Spyware","Stealer","ransomware","crypt","cryptolocker","downloader","locker","rensen","hiddentear","windows-server-utility","evasive"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"66fc2283c3b83799020bfc56","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Rensenware.exe","analysis_start_time":"2024-10-01T16:25:39+00:00","indicators_count":{"informative":41,"suspicious":8,"malicious":2},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"6482cbff1a02b402db0c24bd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Ransom.HiddenTears","submit_name":"04756899.exe","analysis_start_time":"2023-06-09T06:51:43+00:00","indicators_count":{"informative":85,"suspicious":26,"malicious":6},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"63ce4c6198492e438e224903","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"rensenware.vir","analysis_start_time":"2023-01-23T08:59:14+00:00","indicators_count":{"informative":31,"suspicious":20,"malicious":4},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"58e78316aac2ed5135d9a0df","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","error_type":"Failed to save report to webservice","verdict":"malicious","threat_score":91,"malware_family":"Ransom.HiddenTears.Generic","submit_name":"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a","analysis_start_time":"2017-04-08T02:36:55+00:00","indicators_count":{"informative":7,"suspicious":5,"malicious":5},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}],"processes":[{"pid":6008,"ppid":0,"name":"Rensenware.exe","command_line":"","sha256":"7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a","normalized_path":"C:\\Rensenware.exe","uid":"00000000-00006008","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":2956,"ppid":6008,"name":"fondue.exe","command_line":"/enable-feature:NetFx3 /caller-name:mscoreei.dll","sha256":"d61b30a1229479227788ba58efc2648a5faa02f522ae1d24cc9c9dc052a28945","normalized_path":"%WINDIR%\\system32\\fondue.exe","parent_uid":"00000000-00006008","uid":"00000000-00002956"},{"pid":1548,"ppid":2956,"name":"OptionalFeatures.EXE","command_line":"/enable-feature:NetFx3 /caller-name:mscoreei.dll","sha256":"7e268e84be367e28d1d97637cc1e024e7740b04c61a21b76021a315d60b535a9","normalized_path":"%WINDIR%\\system32\\OptionalFeatures.EXE","parent_uid":"00000000-00002956","uid":"00000000-00001548"}],"all_imported_dlls":["System.Drawing.ni.dll","gdi32.dll","imm32.dll","profapi.dll","cryptbase.dll","shfolder.dll","bcrypt.dll","ntdll.dll","advapi32.dll","shell32.dll","mscorlib.ni.dll","System.Windows.Forms.ni.dll","cryptsp.dll","sechost.dll","mscoree.dll","kernel32.dll","usp10.dll","uxtheme.dll","mscorjit.dll","msvcrt.dll","user32.dll","lpk.dll","mscorwks.dll","rsaenh.dll","KernelBase.dll","mscoreei.dll","shlwapi.dll","msctf.dll","msvcr80.dll","System.ni.dll","rpcrt4.dll","ole32.dll","atlthunk.dll","ws2_32.dll","oleacc.dll","npmproxy.dll","virtdisk.dll","pcacli.dll","bcryptprimitives.dll","version.dll","osbaseln.dll","Windows.StateRepositoryPS.dll","iertutil.dll","wldp.dll","win32u.dll","propsys.dll","msi.dll","comctl32.dll","AppResolver.dll","dwmapi.dll","sspicli.dll","ServicingCommon.dll","CoreMessaging.dll","srvcli.dll","sfc_os.dll","VxSSL64.dll","combase.dll","SHCore.dll","xmllite.dll","edputil.dll","gdi32full.dll","cfgmgr32.dll","OneCoreUAPCommonProxyStub.dll","oleaut32.dll","TextInputFramework.dll","netutils.dll","msvcp_win.dll","CoreUIComponents.dll","netprofm.dll","userenv.dll","TextShaping.dll","mpr.dll","clbcatq.dll","CbsApi.dll","WinTypes.dll","windows.storage.dll","apphelp.dll","ucrtbase.dll","duser.dll","fltLib.dll","urlmon.dll","BCP47Langs.dll","kernel.appcore.dll","devobj.dll","wship6.dll","nsi.dll","wer.dll","dnsapi.dll","api-ms-win-core-synch-l1-2-0.dll","psapi.dll","mscordacwks.dll","mswsock.dll","msasn1.dll","winhttp.dll","IPHLPAPI.DLL","winnsi.dll","Culture.dll","mscorrc.dll","dhcpcsvc6.dll","schannel.dll","dbghelp.dll","webio.dll","verifier.dll","rasadhlp.dll","crypt32.dll","SensApi.dll","WSHTCPIP.DLL","powrprof.dll","FWPUCLNT.DLL","rpcss.dll","diasymreader.dll","dhcpcsvc.dll","credssp.dll","setupapi.dll","aepic.dll","ntmarta.dll","sfc.dll","dbgcore.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dH1rDN9f9.doc.RENSENWARE","sha256":"b5700f30e932d8d04300e95e899d04d69aab10f734084a9651a8572b68ed7886","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"klmqz.doc.RENSENWARE","sha256":"a9881495c83d6c43c6418c958b79508dce4a499ee4d10fd037df90b54219dbb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"3AVoUo9c20GI.pdf.RENSENWARE","sha256":"bd807b38f771a3e81015fb8af62b52b7fb143807e63eae703dfeb99abb2244d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"GgPR9V5hPE8bUpO.jpg.RENSENWARE","sha256":"aec188467f494ea0ead650559414b138ef044ff6d8f6d36117521a3eef8ea31a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"86iRpMfVS9o.jpg.RENSENWARE","sha256":"47383b68c1ad4e5766a3332c3ea264b2d4a6a58fd509ff80b22559947a40c198","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"7ZOfXpturAqbd1c.avi.RENSENWARE","sha256":"91380766702a6460841e0fcfdb32e4b78f8f43b26bee10fd317dfa8834d5292c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"1N1A3vlRdYRii5C.mp3.RENSENWARE","sha256":"b41a75d4eebf8346941e68a6e5a6b28631c30c0b66de1b04104e43d1360a8632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"rbfKgDSibNA52.rar.RENSENWARE","sha256":"9a223a9182bc9cdb5e212fb505108d84a1cecd14331e3fb2068f41108bc2d968","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"nptZgkCVl0OD.mp3.RENSENWARE","sha256":"b7353fc69f0b029b0a1a0f3faaee5fc314c3e96a2c841cb391f2808767fa73c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"hCmeX1Ct3FFL6dk.jpg.RENSENWARE","sha256":"567a842deac5ae1b2735d909c5e0ef00aa70247f6d2ed39394182d38c218c1f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"b9UD.jpg.RENSENWARE","sha256":"d85c8a1647a07547e335f36ad5f3f8462c8cb7e31d107d0f87c0372760132dad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"RTgAfRGNR0qKZtig.jpg.RENSENWARE","sha256":"22479211afcdeb9e8f6afc8bc7b61c92e02fa2acd11e2a0a699ca78f35b004bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"6MR6.mp3.RENSENWARE","sha256":"a7a67e6873a26a4f200bebb2be614b8daeff35705125fe782fd2b04e3fe942bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"aGAui.avi.RENSENWARE","sha256":"94f12e3cf4373abb15258855fb59bb7248390daa14037b221920e7c90f83e8e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"Jm34QKUSbOJ.pdf.RENSENWARE","sha256":"5d332a208f09aaafb66b55e43cd684bf4457265ccfc0d91577225dff346afbae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"Mfc8nmRBfzSVE.txt.RENSENWARE","sha256":"b592bfeb83fabc133ca256aa644a2372cdb8f84a3a37638c91287004ff5100d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"C04T72pR0Bcl.doc.RENSENWARE","sha256":"4512e1ce2de46f1b51b099c4c990bc0868a76de066504e923764ee4994c96f7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"EIy4cIf3Sw.pdf.RENSENWARE","sha256":"8bdf75275a0970401705a1d34578dbac7781d4515293fc738397b735231630c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"hKY8.doc.RENSENWARE","sha256":"bad0a36651da527e12c5898e6fb50b3dd42d56e35dbb36c230711afc040dcc33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"acZ9pR3WMOxAcq.txt.RENSENWARE","sha256":"740442a3cab6d61e6acc469f6f6bd7e80f82dd86a8bf746e222dd0a67a3400d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"name":"WERA2AA.tmp.WERInternalMetadata.xml","sha256":"1bdb5ece7423e8a62435771ed03f26514c7a9b64df49a64f2287a058ae03cae3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"Report.wer","sha256":"3d9160ccbe05d2cf0e8158967844ec71f6d236d3082fdba44042cc65879c3964","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"WERAA7B.tmp.hdmp","sha256":"b359628c0489354c76c060086646880e016624f8c358330f62e9bfc14549e6ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"WER5C05.tmp.mdmp","sha256":"5fb38754ab6cebd224264ab99f65c4943a0202d16c78d2e35e1a84fc3b7782dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"0MTtHojL.rar.RENSENWARE","sha256":"7105cc1efb30ad4db183418a9a00c6b06ce0cee7e64db93b5cdb1f6f67af94ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"0vAOzfx2r.mp3.RENSENWARE","sha256":"f0d7852ed440ae8e757072356eb6e985add40e7e12d127b027a0c94c181424b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"2MffCJz16PvEB.avi.RENSENWARE","sha256":"78791317190a68aaf7b44fc36b3a4ebb2c69266c26ca375b53d9ed1465a296da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"2VEV49vrsTLgZa.doc.RENSENWARE","sha256":"9fc3701d91e53d50fba7bb9bc5d67455c6843fdd25922a7f830fe8ed7df297e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"2w1w1py1F.txt.RENSENWARE","sha256":"ae339c43d0fdbebbd66d5900df22d6d1b2a381d6af54017751903617d137ced1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"2zcZSXtZc.jpg.RENSENWARE","sha256":"f6750716f34eae1113f5ef2cb954f245f1b53d8e679af5776ac2fd4998c888c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"3LnBJn.doc.RENSENWARE","sha256":"6ce477a97772a7eb4a65c6d986496b2493f4d58ab3da4e12a1f83424d221d4e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"3OleWh3.rar.RENSENWARE","sha256":"c1958573f02814501a35285e971071352af6e0817dae81fcc500199fd907f241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"3dGXIt7I2ITpav.jpg.RENSENWARE","sha256":"22f4b1ffa2d8bde16244bd08e126f078a5ded3fc5881a1bd3c3e2b86e8aab430","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"4E0qAxNiq7QCMAH.txt.RENSENWARE","sha256":"06d2209b75b1c536d86885ef883fc35e737eb2ebc71f73d89f84f794944f0b06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"4JMQP51xRP4ubhP.pdf.RENSENWARE","sha256":"f5e355dc5b4ece2c3b531ca735bddc778182a5e4a50c8c864b13700fee9bef85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"5F7TBCLUxJG.doc.RENSENWARE","sha256":"b1beb963714a7c754fb508ace3bffabb09ea9af7c726fdc71fb6b9e4ea3fe71f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"5JQ5LUD.pdf.RENSENWARE","sha256":"5aec675bbacd74c1094eeadf3d58b659700763e9c03a9f147833d51c9a431624","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"5lvtAMvrhoXfL.pdf.RENSENWARE","sha256":"9ad71eebb44e4786d2dd1a029700aa18d0662b08006c78a442f64aa57b8fc6c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"66cBVUILav7b.txt.RENSENWARE","sha256":"6741ef43e2204fb83436fe79c69bf6c612c31679bce3b913d1c7a5c100c0d514","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"6Mezlh.jpg.RENSENWARE","sha256":"899fdc5d92e4b5424ab945cbd4d7ad1aad6b44e9fd93d32f6a06a749a31c3369","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"WERA8AC.tmp.mdmp","sha256":"7976e625c9c4757ccf276a51343aa88390ca201caccf706452c77429f073ca37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"WERBFDE.tmp.WERInternalMetadata.xml","sha256":"a5a46e4f46733b8642a48e9e5c288e10b0bdac8bcd9d3dcb3e21450b54ed1871","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"C:\\7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.exe.config","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"C:\\7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a.exe","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"}]},{"path":"%USERPROFILE%\\Downloads\\6x7ogLEUua7P0r.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\6XKtluzfd94XxpU0.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\7apDTq.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\9ld3Swg9d708.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\9Tr896lS2EHhXnXN.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Ae5I9Tp.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\agR7veM.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\aV63jolkZYRS.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\b351j5J.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\b83j1whH4AFW.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\bi15sDCCo6KP.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\bMTL7.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\bmwV9wV922aP.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\BvPHO2whvH.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\BwGP.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\c6U0diDPlb.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\CXTZW9A2KnJ.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\D5XQTXC52pXqq.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\dADsR8ADZA.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\DPYao.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\dr8KhOqi3s1qY.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\dS50hM5BYSkIp3.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\eb2tXA9etKa8.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\eM37v5eGuj.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\EryDt.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\ETlJ.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Ety4Pk.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\FfPBcMgB2Ib75pJ.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\FMLv5xQw.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\fSKfQrVkIa.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\G5WwC5qR9t40.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\G91s2xrIF8.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\gDM3cBUwMXp.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\GgHlzQR.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\gSFISiLdEqY.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\gtcmotdmF.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\HKfMbc4O5Dq.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\HoJQ.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\I13AS0JPyzcp.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\I1FDKUv.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\iBYXJxQ8Din.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Ie2iSU.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\IGMUa.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\iOtp3dhgvMzgM6W.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\IRHrwbIBYqqeSb.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\IzKTG5xkG23Vx.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\j8Sa.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\JZ2pMXx3Vcrzbyv.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\K9q7qDW.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\kFzK44eiZQZaqb58.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\kK87N1OZJcg.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\kOMe5UUGx3N.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\kw4EOhPqkuy4R.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\kWJdgQhlUBI.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\kX1EFgv2SQpv.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\kzZRlf1JIN1Fc0.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\loDXvpcbM2t.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\lZIxyQanY806dPvo.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\NUphetxlkgkR.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\OpKgf.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\OxaGutTgg.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\paDPuaXhZv0D.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\piLMujsJtKhePpUk.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\pJ5LdT.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\pv2QM3mvvNti.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\PxTEGsz.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\QGt9U37rl.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\QN3biJOjxEXdZ.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\QP5MQD2NHGKrPzwr.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\qSjvFasnrz.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\R8faJrHD.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\RAXI.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\RbtW4G2kFg1PKp.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Rh6K1OQC5.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\rpX8ntbi.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Rwr6Ln6VKYDSx.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\sIDdZiPdO4tdT.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\SYqt4.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\TzuQwEH0h0MzE1Ky.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\u6ab20.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\UIge59Lo.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\UiH0aQKghKZYS.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\UlVd.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\UP97ZKmN.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\UulKwY.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\uV18Udm.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\VB7SPB.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\VOjZkMZ5a.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\vx46EIEaSV.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\vzBvHbT.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\W762dN.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\wJkF3y0uq4.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\wK4Ww80v3.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\WMmZ.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\x6VWs.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\XF9IG.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\xHkhUwrp.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\XQiAhjKVGn.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\XsxV2lbQmEdqvn.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\5JQ5LUD.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\xvwDmwjSYSj.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\88RVD.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\8lo1U4.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\9kzZfe.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\9mVfR93Ya0MhJ4r.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Yo6yX0csq8lANU.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\yPetOc6pYJDfX4.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\yuUok.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\ywR7NfpXdps.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\B1quCrDurbd4XKkA.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\ZRUs74FSqT98Ni.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\CZspj.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\DKwpgw.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\G9mKqAA.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\gPs5E5MFXNCgyb.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Hs28ATfZ2n.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\I8mXeIsqVW.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\ISVsu.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\jn5O.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\jwqS0glEK.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\L2qZa54hNih3FI.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Lw3Fb9jReo6E.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\m3I6.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\mMiZaSTm.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\mUJfe.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\MXf3Y8G12MNbrM.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\nOzfbva0sbjztzm.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\PnUU42S.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\pSTvHOZK.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\q4ELNH.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\qEtregYQhaZNNrmZ.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\QlwjqHS.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Qpn8etOi4.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\ryO8PQfX4JxY.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\sFbzgHs1K3qLZF41.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\SI7SrSNA.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\sMnAqNs7sI4.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\sypJbNqx.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\ta9qL1LD4wzv.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\tASbO1fq72.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\TE8y4bplCG5E.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\tErhGo50ST8.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\tjYU.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\TkLNxcfvs00Ke.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\tpnUorm2s9.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\TURpw.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\u8rbs.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\V75WwbfpWWqom.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\VbHDJoz8cFwr.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\WOWs6ef3DQ.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\WtsXtW5R9qfG5.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\wTXpSXByYWhq77q.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\x0ZXVuIW7oY.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\x3v5LlWcHSgEU.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\XYTRIrr4j.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Y0j4RMf.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Y1hskgBUYrJFg0zK.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\Y6pGvfMsWHL0xm.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\yP1Ciwh3K3C1.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\ZlT0.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%TEMP%\\WERA2AA.tmp","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%TEMP%\\WERAA7B.tmp","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%TEMP%\\WER5C05.tmp","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"},{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"path":"%USERPROFILE%\\Downloads\\0MTtHojL.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\0Sp0C2.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\0vAOzfx2r.mp3.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\1N9XZhECgqNiztI.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\2MffCJz16PvEB.avi.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\2VEV49vrsTLgZa.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\2w1w1py1F.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\2zcZSXtZc.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\3dGXIt7I2ITpav.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\3LnBJn.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\3NalgQ7T61.gif.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\3OleWh3.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\4E0qAxNiq7QCMAH.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\4JMQP51xRP4ubhP.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\5F7TBCLUxJG.doc.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\5lvtAMvrhoXfL.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\66cBVUILav7b.txt.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\6Mezlh.jpg.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\6pgHJumsDCsNOSW0.pdf.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\6rBWK5p0shM2.rar.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"path":"%USERPROFILE%\\Downloads\\npp.8.4.7.portable.x64.zip.RENSENWARE","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"58e78316aac2ed5135d9a0df"},{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"key":"\\REGISTRY\\A\\{E362967F-A4A3-255C-4118-85600F052BF9}\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"key":"\\REGISTRY\\A\\{E362967F-A4A3-255C-4118-85600F052BF9}\\ROOT\\INVENTORYAPPLICATIONFILE\\","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"key":"\\REGISTRY\\A\\{E362967F-A4A3-255C-4118-85600F052BF9}\\ROOT\\INVENTORYAPPLICATIONFILE\\PERMISSIONSCHECKTESTKEY\\","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"key":"\\REGISTRY\\A\\{E362967F-A4A3-255C-4118-85600F052BF9}\\ROOT\\INVENTORYAPPLICATIONFILE\\04756899.EXE|419AE35814CA0E6B\\","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}],"keys_modified":null,"keys_deleted":[{"key":"\\REGISTRY\\A\\{E362967F-A4A3-255C-4118-85600F052BF9}\\ROOT\\INVENTORYAPPLICATIONFILE\\PERMISSIONSCHECKTESTKEY\\","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"name":"Local\\SM0:6008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66fc2283c3b83799020bfc56"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\冰ǽ","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"Global\\冰ǽ","sources":[{"report_type":"sandbox","report_id":"63ce4c6198492e438e224903"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6188:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"Local\\SM0:6188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"SM0:6188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"SM0:6188:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"\\BaseNamedObjects\\AmiProviderMutex_InventoryApplicationFile","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"\\BaseNamedObjects\\128fb1e1-94e4-49df-84f3-d981183b4471","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]},{"name":"SM0:3012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6482cbff1a02b402db0c24bd"}]}]}},"report_ids":{"sandbox_job_ids":["66fc2283c3b83799020bfc56","6482cbff1a02b402db0c24bd","63ce4c6198492e438e224903","58e78316aac2ed5135d9a0df"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.HiddenTears.Generic Sample 7bf5623f0a10… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7bf5623f0a10…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.HiddenTears.Generic Sample 7bf5623f0a10… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7bf5623f0a10…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.HiddenTears.Generic Sample 7bf5623f0a10… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7bf5623f0a10…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]