34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 53:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Lockbit.Generic Sample 83600bb9bb3e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 83600bb9bb3e…. Malware family: Ransom.Lockbit.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68","keywords":["Malicious","Ransom.Lockbit.Generic","malware analysis","sandbox report","threat intelligence","83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68"],"about":{"@type":"SoftwareApplication","name":"bounty-46970758280656213","applicationCategory":["peexe","executable"],"identifier":"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Lockbit.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T10fc,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\desktop.ini" to "C:\$Recycle.Bin\S-1-5-18\AAAAAAAAAAA" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\AAAAAAAAAAA" to "C:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBB" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBB" to "C:\$Recycle.Bin\S-1-5-18\CCCCCCCCCCC" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\CCCCCCCCCCC" to "C:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDD" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDD" to "C:\$Recycle.Bin\S-1-5-18\EEEEEEEEEEE" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\EEEEEEEEEEE" to "C:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFF" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFF" to "C:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGG" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGG" to "C:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHH" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHH" to "C:\$Recycle.Bin\S-1-5-18\IIIIIIIIIII" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\IIIIIIIIIII" to "C:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJ" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJ" to "C:\$Recycle.Bin\S-1-5-18\KKKKKKKKKKK" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\KKKKKKKKKKK" to "C:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLL" to "C:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMM" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMM" to "C:\$Recycle.Bin\S-1-5-18\NNNNNNNNNNN" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\NNNNNNNNNNN" to "C:\$Recycle.Bin\S-1-5-18\OOOOOOOOOOO" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\OOOOOOOOOOO" to "C:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPP" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPP" to "C:\$Recycle.Bin\S-1-5-18\QQQQQQQQQQQ" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\QQQQQQQQQQQ" to "C:\$Recycle.Bin\S-1-5-18\RRRRRRRRRRR" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\RRRRRRRRRRR" to "C:\$Recycle.Bin\S-1-5-18\SSSSSSSSSSS" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\SSSSSSSSSSS" to "C:\$Recycle.Bin\S-1-5-18\TTTTTTTTTTT" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\TTTTTTTTTTT" to "C:\$Recycle.Bin\S-1-5-18\UUUUUUUUUUU" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\UUUUUUUUUUU" to "C:\$Recycle.Bin\S-1-5-18\VVVVVVVVVVV" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\VVVVVVVVVVV" to "C:\$Recycle.Bin\S-1-5-18\WWWWWWWWWWW" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\WWWWWWWWWWW" to "C:\$Recycle.Bin\S-1-5-18\XXXXXXXXXXX" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\XXXXXXXXXXX" to "C:\$Recycle.Bin\S-1-5-18\YYYYYYYYYYY"37:T677,Found XOR loop in file "sample.bin" at offset 110592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 24643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 24793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 24960; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26447; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 139894; code bytes = 803038:T101e,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f800640000000685b871000038030000000040000000000000003cf3f500b084b8710000380300000000186739034cf3f5007c3cb871186739030000000058f3f5003a05b87118673903bcf3f500aff1b77118673903400000005b0a860e80f4f50000000000120000009e29b57728de39030000000028000000240000000000380340f4f5003f005c0063003a005c0000000000000007000000d007f80030000000e8f5f500120000000000f80050f4f5007700b671314f3ad600000000a0da3903b8b238031200000000000000200000000000f800d001f800440bf80000000000400bf8000000000038f4f50050f5b47728de3903a0f4f500ecf4f500 (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000008f4f500acf3f500226ef47500005505000000002d6ef47529e4c1692d000000ecb7577430f4f5000000f80098d2390390b238030e0000008000000070f3f5000000f800f4f3f50070c8f5757d66ce1cfeffffff2d000000d0cc667427000000c4f3f500856af6751c23fb7504f4f500f85ff67508000000bb69f575b269f57581e3c1692d000000ecb7577427000000d0cc6674d8f3f5002d000000d0cc66742700000008f4f500856af6751c23fb7550f4f5007e8a6574ee8c6574738a65748a415a222d000000ecb7577427000000d0cc66742c115505c01055058a415a2218f4f500fc52a37404f5f500e0846574e2440e56feffffff738a6574 (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000f47500005505000000002d6ef47501e4c16911000000181a9d7208f4f500000055006002550511000000110000008000000048f3f50000000000ccf3f50070c8f5757d66ce1cfeffffff11000000503c9e720e0000009cf3f500856af6751c23fb75dcf3f500f85ff67508000000bb69f575b269f57559e4c16911000000181a9d720e000000503c9e72b0f3f50011000000503c9e720e000000e0f3f500856af6751c23fb7528f4f500b90e9e7236149e72ae0e9e72df4f8c6611000000181a9d720e000000503c9e72202f5505e82e5505df4f8c66f0f3f5000a5e9d72dcf4f50040149e72af19e614feffffffae0e9e72c80e9e72503c9e7258f4f500 (UID: 00000000-00006996)39:T1d23,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006996)3a:Tf9f,Found reference to API (Indicator: "GetAtomNameW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetFileAttributesW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "LoadLibraryW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetCommandLineA"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "LoadImageW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "CreateSolidBrush"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "SelectObject"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetTextColor"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetLocaleInfoW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetModuleHandleA"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetProcAddress"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetLastError"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetCommandLineW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetModuleHandleW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "FreeLibrary"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "DefWindowProcW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetWindowTextW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "CreateWindowExW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "LoadMenuW"; File: "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68") Found reference to API (Indicator: "GetTextColor"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "LoadMenuW"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp")3b:T131d,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77470000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "KERNEL32" at base 75980000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "NTDLL" at base 77b10000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "NTDLL.DLL" at base 77b10000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "KERNEL32.DLL" at base 75980000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "ADVAPI32.DLL" at base 75ce0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "CRYPTBASE" at base 74520000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "USERENV.DLL" at base 730e0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "USER32.DLL" at base 772c0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "GDI32.DLL" at base 76590000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "SHELL32.DLL" at base 74550000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "OLE32.DLL" at base 76d90000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0" at base 777a0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "SHLWAPI.DLL" at base 76620000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "OLEAUT32.DLL" at base 76670000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "WTSAPI32.DLL" at base 741a0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "RSTRTMGR.DLL" at base 730b0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "NETAPI32.DLL" at base 73040000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "WKSCLI" at base 73320000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "SRVCLI" at base 73020000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "SAMCLI" at base 73000000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "NETUTILS" at base 732e0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "LOGONCLI" at base 72fd0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "ACTIVEDS.DLL" at base 72f90000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "WININET.DLL" at base 72c80000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "WSOCK32.DLL" at base 72c70000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "WS2_32" at base 76720000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "MPR.DLL" at base 74430000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "WINSPOOL.DRV" at base 72c00000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "GPEDIT.DLL" at base 72af0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fe0000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77470000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72950000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72820000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "RPCRT4.DLL" at base 77a50000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72810000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77470000 "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 774700003c:T4a3,"0f0010007cfdf500b013b577fcfdf500@ntdll.dll" "0700080058fdf50080fdbf77d8fdf500@ntdll.dll" "09000a0058fdf500c0fdbf77d8fdf500@ntdll.dll" "0800090058fdf500e0fcbf77d8fdf500@ntdll.dll" "0700080058fdf500e085b377d8fdf500@ntdll.dll" "09000a0058fdf5008057b377d8fdf500@ntdll.dll" "0800090058fdf500e056b377d8fdf500@ntdll.dll" "1100120058fdf500702a5274d8fdf500@CRYPTBASE.dll" "1100120058fdf500e02a5274d8fdf500@CRYPTBASE.dll" "0c000d0058fdf500003d8977d8fdf500@combase.dll" "0e000f0058fdf500106e8377d8fdf500@combase.dll" "0e000f0058fdf500606e8377d8fdf500@combase.dll" "1400150058fdf50020238077d8fdf500@combase.dll" "1000110058fdf50080048377d8fdf500@combase.dll" "1200130058fdf50010c78977d8fdf500@combase.dll" "1100120058fdf50050bc8377d8fdf500@combase.dll" "1500160058fdf500c0323273d8fdf500@WKSCLI.DLL" "0c000d0058fdf50010430273d8fdf500@SRVCLI.DLL" "0b000c0058fdf50080390073d8fdf500@SAMCLI.DLL" "0e000f0058fdf500d0da0073d8fdf500@SAMCLI.DLL" "0e000f0058fdf500403e0073d8fdf500@SAMCLI.DLL" "1000110058fdf500d0172e73d8fdf500@NETUTILS.DLL" "0c000d0058fdf50050effd72d8fdf500@LOGONCLI.DLL" "0c000d0058fdf50050cffe72d8fdf500@LOGONCLI.DLL" "0c000d0058fdf500d0cdfe72d8fdf500@LOGONCLI.DLL"3d:T4b0,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" touched "WbemAdministrativeLocator Class" (Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")3e:T453,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68" file has an entrypoint instructions - "nop ,call 0x41b000,call 0x408214,call 0x40b7b4,call 0x418ec8,push 0,call dword ptr [0x4275c0],call 0x41a836,call 0x41a82a,call 0x41a836,call 0x41a830,call 0x41a82a,call 0x41a824,call 0x41a81e,call 0x41a80c,call 0x41a80c,call 0x41a812,call 0x41a80c,call 0x41a80c,call 0x41a818,call 0x4193b2," "CC08.tmp" file has an entrypoint instructions - "dec ebp,fadd qword ptr [esi - 0x23],pop ds,and bl, byte ptr [esp + edx - 0x10],sets byte ptr [esi],jns 0x403969,mov cl, 0xa2,inc esi,outsb dx, byte ptr [esi],jae 0x403994,leave ,pop ecx,pop esi,add al, 0x1c,adc esi, dword ptr [0x2a4dc271],push ecx,inc edx,imul edx, dword ptr [edi + 0x3469be44], 0x8822181b,wait ,or al, 0xf2,test al, 0xd6,test al, 0xd,mov bl, bh,movsb byte ptr es:[edi], byte ptr [esi],jb 0x4039a4,fsubr qword ptr [edi - 0x31],jl 0x40397b,sbb al, 0xa5,mov bh, 0xfa,pop ss,push 0x73,and al, bl,sbb byte ptr [edi], al,xlatb ,les edx, ptr [eax - 0x56dc40e0],or byte ptr [esi - 0x1bd161c8], bh,jecxz 0x403a03,loope 0x403a0c,mov esp, 0x86a10260,"3f:T3686,"moment-with-locales.min.js.map.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8c5c6194 bd37c8bf"- [targetUID: 00000000-00006996] "axios.min.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb0c0148 2da846ac"- [targetUID: 00000000-00006996] "index.js.map.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8c1f14c5 e68cbab5"- Location: [C:\tempdir\node_modules\sift\lib\index.js.map.NOokKHoMb]- [targetUID: 00000000-00006996] "connection_string.js.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8cf57ba5 c3e8a6f5"- Location: [C:\tempdir\node_modules\mongodb\lib\connection_string.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cb1f889 cc12fd6d"- Location: [C:\tempdir\node_modules\mongoose\types\index.d.ts.NOokKHoMb]- [targetUID: 00000000-00006996] "websocket.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe9c0126d da7dbd25"- [targetUID: 00000000-00006996] "readline.d.ts.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0xb894538a 684ed0b9"- [targetUID: 00000000-00006996] "CC08.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- [targetUID: 00000000-00006996] "polling.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe96702b7 fa0e8008"- [targetUID: 00000000-00006996] "template.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb7cb79b e564612c"- [targetUID: 00000000-00006996] "unicode-base.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb40d576 2b90c98b"- Location: [C:\tempdir\node_modules\xregexp\src\addons\unicode-base.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8a2a27e 71028583"- Location: [C:\tempdir\node_modules\mongoose\lib\error\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c3a98de 7e7c9a53"- Location: [C:\tempdir\node_modules\proxy-addr\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "sr-cyrl.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8f2551c eb6f3c13"- [targetUID: 00000000-00006996] "ar.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe9ce08e5 451b5fb2"- [targetUID: 00000000-00006996] "applyHooks.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb600c3d 1929989a"- Location: [C:\tempdir\node_modules\mongoose\lib\helpers\model\applyHooks.js.NOokKHoMb]- [targetUID: 00000000-00006996] "websql-db.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb841bb5a 129dc9bd"- [targetUID: 00000000-00006996] "index.js.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ca996fa aaa8f3ca"- Location: [C:\tempdir\node_modules\socks-proxy-agent\dist\index.js.map.NOokKHoMb]- [targetUID: 00000000-00006996] "pa-in.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb820e653 f33ee9cc"- [targetUID: 00000000-00006996] "README.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb881430e 5024352b"- Location: [C:\tempdir\node_modules\proxy-addr\README.md.NOokKHoMb]- [targetUID: 00000000-00006996] "bn.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cb66506 768e8f9f"- [targetUID: 00000000-00006996] "README.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c8fccc 1a31f580"- [targetUID: 00000000-00006996] "th.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb86bece0 95dae442"- Location: [C:\tempdir\node_modules\yargs\locales\th.json.NOokKHoMb]- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c32be34 6ab22dc5"- Location: [C:\tempdir\node_modules\pm2-axon-rpc\node_modules\ms\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "timeout.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe93f085b 29c1e6e8"- [targetUID: 00000000-00006996] "unwrap.tap.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c11028b 358a5f57"- Location: [C:\tempdir\node_modules\shimmer\test\unwrap.tap.js.NOokKHoMb]- [targetUID: 00000000-00006996] "th.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cd535a9 c19c5798"- [targetUID: 00000000-00006996] "README.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb86931bb 3a100e57"- Location: [C:\tempdir\node_modules\require-in-the-middle\README.md.NOokKHoMb]- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8b1ccf3 e40a0d4a"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb850ee1b 6aaafc3e"- Location: [C:\tempdir\node_modules\semver\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "it-ch.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c035ab1 77723510"- [targetUID: 00000000-00006996] "utc.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cd67bc1 6dd3856f"- [targetUID: 00000000-00006996] "readme.md.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0xb8294b59 15367ddb"- Location: [C:\tempdir\node_modules\socket.io-parser\node_modules\ms\readme.md.NOokKHoMb]- [targetUID: 00000000-00006996] "readme.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb888b7e5 ec6158cb"- [targetUID: 00000000-00006996] "array.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8d29806 69dc99eb"- [targetUID: 00000000-00006996] "applyEach.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c2ac240 c02e2fa6"- [targetUID: 00000000-00006996] "decodePacket.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8842721 4fc1fe0b"- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb3088a7 b2776471"- [targetUID: 00000000-00006996] "ProgressTracker.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb19b348 4a676b6d"- [targetUID: 00000000-00006996] "ipv4.d.ts.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c36620 c2d910bb"- [targetUID: 00000000-00006996] "reject.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb30f422 df888090"- Location: [C:\tempdir\node_modules\vizion\node_modules\async\reject.js.NOokKHoMb]- [targetUID: 00000000-00006996] "_createPartial.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c95e7ac 3905d0fb"- [targetUID: 00000000-00006996] "ca.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb02d031 41d46305"- [targetUID: 00000000-00006996] "en-gb.js.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8c08f78a 5d5006c3"- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8d112b4 c26d8f97"- [targetUID: 00000000-00006996] "SECURITY.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb6ef214 25e6a1c0"- Location: [C:\tempdir\node_modules\send\SECURITY.md.NOokKHoMb]- [targetUID: 00000000-00006996] "LICENSE.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c957ed 1796b8b1"- [targetUID: 00000000-00006996] "forEachOfSeries.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c95a70c c9c3d182"- Location: [C:\tempdir\node_modules\vizion\node_modules\async\forEachOfSeries.js.NOokKHoMb]- [targetUID: 00000000-00006996] "size.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c48c246 abfbe4e6"- [targetUID: 00000000-00006996] "ht.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c578fef 5a3d6122"- [targetUID: 00000000-00006996] "license.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb44ee90 bd7307f2"- [targetUID: 00000000-00006996] "_customDefaultsMerge.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb844189d 3fac896c"- [targetUID: 00000000-00006996] "fr-ca.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c235bda 7961af66"- [targetUID: 00000000-00006996] "constants.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cfc89b1 f4a2af90"- [targetUID: 00000000-00006996] "badMutable.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8eed8d9 ee304792"- [targetUID: 00000000-00006996] "bs.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8604504 41262cb5"- [targetUID: 00000000-00006996] "prune.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ca7abcf 9acf3445"- Location: [C:\tempdir\node_modules\underscore.string\prune.js.NOokKHoMb]- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb5ba4c8 17e224c1"- [targetUID: 00000000-00006996] "explain.js.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8158bd6 6f4e821d"- Location: [C:\tempdir\node_modules\mongodb\lib\explain.js.map.NOokKHoMb]- [targetUID: 00000000-00006996] "startCase.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c5c5569 5ed7f54f"- [targetUID: 00000000-00006996] "quarterOfYear.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb6a7a8d 17e9875e"- [targetUID: 00000000-00006996] "objectid.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cff9c87 590a0027"- Location: [C:\tempdir\node_modules\mongoose\lib\cast\objectid.js.NOokKHoMb]- [targetUID: 00000000-00006996] "types.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c0cd7ff 561fc32e"- [targetUID: 00000000-00006996] "_baseFunctions.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8a10156 409bda89"- [targetUID: 00000000-00006996] "upperFirst.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8e39d0a 9d50ccd8"- [targetUID: 00000000-00006996] "regular-expressions.d.ts.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cdbef85 4ce4def3"- [targetUID: 00000000-00006996] "_safeGet.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb371301 923f6b27"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ce01fae f8a9f164"- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb868a7f3 38622a4b"- [targetUID: 00000000-00006996] "action.mocha.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb846675e e6d61836"- Location: [C:\tempdir\node_modules\tx2\test\action.mocha.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb0baf33 d786300d"- [targetUID: 00000000-00006996] "isAxiosError.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c4e5b8c c738ba3f"- [targetUID: 00000000-00006996] "obj-filter.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cef913b cafc6214"- Location: [C:\tempdir\node_modules\yargs\build\lib\utils\obj-filter.js.NOokKHoMb]- [targetUID: 00000000-00006996] "stubString.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cc17397 c3a64fbd"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb517fbb 8d4658d7"- [targetUID: 00000000-00006996] "localHostOrDomainIs.d.ts.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb6a36ad 543fe739"- Location: [C:\tempdir\node_modules\pac-resolver\dist\localHostOrDomainIs.d.ts.map.NOokKHoMb]- [targetUID: 00000000-00006996] "code-points-data.js.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c8ed7c 750f8aed"- [targetUID: 00000000-00006996] "ltr.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8dffb4c c2763787"- [targetUID: 00000000-00006996] "multiselect.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb80411d1 61d1bae7"- [targetUID: 00000000-00006996] "clean.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8a56d1c 8e0c0dee"- [targetUID: 00000000-00006996] "difference.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb04d4a0 1d2a494d"- [targetUID: 00000000-00006996] "findIndex.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb466c09 7465386c"- [targetUID: 00000000-00006996] "overArgs.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb4d25da 8e7d4bb4"- [targetUID: 00000000-00006996] "compare.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8d68eed 0fcb900b"- [targetUID: 00000000-00006996] "times.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c5694a9 e5ff5ca2"- [targetUID: 00000000-00006996] "getOr.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb89965e7 854d5231"- [targetUID: 00000000-00006996] "isCancel.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb66ef98 ff86833f"- [targetUID: 00000000-00006996] "mocha.opts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb86c2345 939dfd1f"- Location: [C:\tempdir\node_modules\vizion\test\mocha.opts.NOokKHoMb]- [targetUID: 00000000-00006996] "date.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ca788f0 6f2d9398"- [targetUID: 00000000-00006996] "type.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cd290b0 95924212"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c07a53e 667956f8"- Location: [C:\tempdir\node_modules\picomatch\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "yargs-parser-types.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb852ce46 42e38ae6"- Location: [C:\tempdir\node_modules\yargs\build\lib\typings\yargs-parser-types.js.NOokKHoMb]- [targetUID: 00000000-00006996]40:T7d3,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")41:Te5a,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "83600BB9BB3EBA4CA5D64A300BCDB8BC9C988570F5ACDB6AECAE77F4F75D2E68.EXE"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")42:T896,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\test\dotdot\abc\index.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\lib\async.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\lib\caller.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\lib\homedir.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\lib\is-core.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\lib\normalize-options.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\example\async.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\example\sync.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\resolve\.github\funding.yml.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\requires-port\.travis.yml.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\requires-port\license.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\requires-port\readme.md.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\require-in-the-middle\license.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\require-in-the-middle\readme.md.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" reads file "c:\tempdir\node_modules\require-in-the-middle\node_modules\ms\license.md.nookkhomb"43:T69d,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll"44:T9bc,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\FLTLIB.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\USERENV.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\userenv.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\wtsapi32.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\RstrtMgr.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\NCRYPT.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\ncrypt.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\BCRYPT.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\bcrypt.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\NTASN1.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\NTASN1.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\NETAPI32.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\netapi32.dll" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\WKSCLI.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\SRVCLI.DLL" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" trying to access non-existent file "C:\SAMCLI.DLL"45:T874,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\programdata\nookkhomb.ico" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\$recycle.bin\s-1-5-18\desktop.ini" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\$recycle.bin\s-1-5-21-735145574-3570218355-1207367261-1001\desktop.ini" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\precedence\bbb\main.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\precedence\aaa\index.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\precedence\aaa\main.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\node_path\y\ccc\index.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\node_path\y\bbb\index.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\node_path\x\ccc\index.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\node_path\x\aaa\index.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\module_dir\zmodules\bbb\main.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\module_dir\zmodules\bbb\package.json.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\module_dir\ymodules\aaa\index.js.nookkhomb" "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" writes file "c:\tempdir\node_modules\resolve\test\module_dir\xmodules\aaa\index.js.nookkhomb"46:Tc1b,"http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp "http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion" (Indicator: ".onion") in Source: 00000000-00006996.00000001.124590.03380000.00000004.mdmp 00000000-00006996.00000002.126512.033D8000.00000004.mdmp47:T7e0,Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "\?\c:\tempdir\node_modules\@socket.io" Heuristic match: "\?\c:\tempdir\node_modules\engine.io" Heuristic match: "\??\c:\tempdir\node_modules\mongodb\src\client-side-encryption\providers\azure.ts.nookkhombb.tg" Pattern match: "http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/" Pattern match: "http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/" Pattern match: "http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/" Pattern match: "http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/" Pattern match: "http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/" Pattern match: "http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/" Pattern match: "http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/" Pattern match: "https://twitter.com/hashtag/lockbit?f=live" Pattern match: "https://www.torproject.org/" Pattern match: "http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion" Pattern match: "http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion" Pattern match: "http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion" Pattern match: "http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion" Pattern match: "http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion" Pattern match: "http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion" Pattern match: "http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion" Heuristic match: "\?\c:\tempdir\node_modules\fs-extra\changelog.md" Heuristic match: "\node_modules\glob\changelog.md" Heuristic match: "??\c:\tempdir\node_modules\function-bind\.github\security.md" Heuristic match: "eadme.md" Heuristic match: "hangelog.md" Heuristic match: "nse.md" Heuristic match: "r\node_modules\get-intrinsic\license.no" Heuristic match: "ecurity.md"48:T83f,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found URL "http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/>>>>>" - Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found URL "https://twitter.com/hashtag/lockbit?f=live>>>>>" - Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found URL "https://www.torproject.org/write" - Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found URL "http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.oniontor" - Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found URL "http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onionhttp://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onionhttp://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onionhttp://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onionhttp://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onionhttp://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onionhttp://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>" - Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp")49:T66b,YARA signature to detect high entropy file file "bs.js.NOokKHoMb" YARA signature to detect high entropy file file "axios.min.map.NOokKHoMb" YARA signature to detect high entropy file file "difference.js.NOokKHoMb" YARA signature to detect high entropy file file "regular-expressions.d.ts.map.NOokKHoMb" YARA signature to detect high entropy file file "CC08.tmp" YARA signature to detect high entropy file file "pa-in.js.NOokKHoMb" YARA signature to detect high entropy file file "index.d.ts.NOokKHoMb" YARA signature to detect high entropy file file "connection_string.js.NOokKHoMb" YARA signature to detect high entropy file file "websql-db.js.NOokKHoMb" YARA signature to detect high entropy file file "index.js.NOokKHoMb" YARA signature to detect high entropy file file "applyEach.js.NOokKHoMb" YARA signature to detect high entropy file file "startCase.js.NOokKHoMb" YARA signature to detect high entropy file file "_createPartial.js.NOokKHoMb" YARA signature to detect high entropy file file "type.js.NOokKHoMb" YARA signature to detect high entropy file file "license.md.NOokKHoMb" YARA signature to detect high entropy file file "ProgressTracker.d.ts.NOokKHoMb" YARA signature to detect high entropy file file "README.md.NOokKHoMb" YARA signature to detect high entropy file file "utc.js.NOokKHoMb" YARA signature to detect high entropy file file "isCancel.js.NOokKHoMb" YARA signature to detect high entropy file file "quarterOfYear.d.ts.NOokKHoMb" YARA signature to detect high entropy file file "moment-with-locales.min.js.map.NOokKHoMb" YARA signature to detect high entropy file file "multiselect.js.NOokKHoMb"4a:Tafe,Found string "Device\HarddiskVolume2\tempdir\node_modules\grunt\node_modules\iconv-lite\.github\" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found string "Device\HarddiskVolume2\tempdir\node_modules\grunt-legacy-util\.github\workflows\" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found string "??\C:\tempdir\node_modules\grunt\node_modules\iconv-lite\.github\dependabot.yml.NOokKHoMb" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found string "Device\HarddiskVolume2\tempdir\node_modules\get-intrinsic\.github\" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "Device\HarddiskVolume2\tempdir\node_modules\function-bind\.github\" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "Device\HarddiskVolume2\tempdir\node_modules\mocha\node_modules\brace-expansion\.github\" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found string "??\c:\tempdir\node_modules\function-bind\.github\security.md" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "??\C:\tempdir\node_modules\function-bind\.github\SECURITY.md" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "??\C:\tempdir\node_modules\function-bind\.github\SECURITY.md.NOokKHoMb" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "??\C:\tempdir\node_modules\function-bind\.github\NOokKHoMb.README.txt" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "??\c:\tempdir\node_modules\function-bind\.github\security.md.nookkhomb" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "??\c:\tempdir\node_modules\function-bind\.github\funding.yml.nookkhomb" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "??\C:\tempdir\node_modules\get-intrinsic\.github\NOokKHoMb.README.txt" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "\??\C:\tempdir\node_modules\function-bind\.github\FUNDING.yml.NOokKHoMb" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp") Found string "\??\C:\tempdir\node_modules\function-bind\.github\SECURITY.md.NOokKHoMb" (Indicator: "github\"; Source: "00000000-00006996.00000002.126512.033D8000.00000004.mdmp")4b:Tec2,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter aadauthhelper.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter aadtb.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AboveLockAppHost.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter accountaccessor.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AccountsRt.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AcGenral.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AcLayers.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AcSpecfc.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter ActivationClient.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter ActivationManager.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter ActiveSyncProvider.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AcWinRT.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter acwow64.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AcXtrnal.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AdaptiveCards.dll (UID: 00000000-00006996) "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" called "FindNextFileW" with parameter AddressParser.dll (UID: 00000000-00006996)4c:Te48,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp")4d:T133b,Found reference to API "11814687396,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11817339212,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11818841802,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11818481930,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11820890578,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11815822668,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11817749394,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11819343642,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11807376422,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11815442042,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11821606994,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11821243018,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11819755758,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "11820538134,6764,3119,,FindNextFileW,kernel32.dll,"00:31:56.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp") Found reference to API "83778369190,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.703",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83552337296,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.609",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83261066236,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.484",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83651679251,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.656",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83482253796,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.578",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83618436227,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.640",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83779141180,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.703",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83778758878,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.703",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83222237365,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.468",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83746118229,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.687",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp") Found reference to API "83669639162,8932,3119,,FindNextFileW,kernel32.dll,"00:32:26.656",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp")4e:T47b,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004968.00000000.129493.027C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}0" (Indicator: "\Device\"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp")4f:T473,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")50:Tc29,Dropped file "C:\tempdir\node_modules\sift\lib\index.js.map.NOokKHoMb" has high entropy 7.995304164513894 Dropped file "C:\tempdir\node_modules\mongodb\lib\connection_string.js.NOokKHoMb" has high entropy 7.99606402708156 Dropped file "C:\tempdir\node_modules\mongoose\types\index.d.ts.NOokKHoMb" has high entropy 7.99505793060285 Dropped file "C:\tempdir\node_modules\xregexp\src\addons\unicode-base.js.NOokKHoMb" has high entropy 7.9788089995490115 Dropped file "C:\tempdir\node_modules\mongoose\lib\error\index.js.NOokKHoMb" has high entropy 7.972625177102077 Dropped file "C:\tempdir\node_modules\proxy-addr\index.js.NOokKHoMb" has high entropy 7.9708355167944775 Dropped file "C:\tempdir\node_modules\mongoose\lib\helpers\model\applyHooks.js.NOokKHoMb" has high entropy 7.953235912100921 Dropped file "C:\tempdir\node_modules\socks-proxy-agent\dist\index.js.map.NOokKHoMb" has high entropy 7.959207076743908 Dropped file "C:\tempdir\node_modules\proxy-addr\README.md.NOokKHoMb" has high entropy 7.956890681423689 Dropped file "C:\tempdir\node_modules\yargs\locales\th.json.NOokKHoMb" has high entropy 7.954346704606644 Dropped file "C:\tempdir\node_modules\pm2-axon-rpc\node_modules\ms\index.js.NOokKHoMb" has high entropy 7.934370109537614 Dropped file "C:\tempdir\node_modules\shimmer\test\unwrap.tap.js.NOokKHoMb" has high entropy 7.924906813918355 Dropped file "C:\tempdir\node_modules\require-in-the-middle\README.md.NOokKHoMb" has high entropy 7.936058436492323 Dropped file "C:\tempdir\node_modules\semver\index.js.NOokKHoMb" has high entropy 7.930267063853519 Dropped file "C:\tempdir\node_modules\socket.io-parser\node_modules\ms\readme.md.NOokKHoMb" has high entropy 7.909184800663468 Dropped file "C:\tempdir\node_modules\vizion\node_modules\async\reject.js.NOokKHoMb" has high entropy 7.861730565258261 Dropped file "C:\tempdir\node_modules\send\SECURITY.md.NOokKHoMb" has high entropy 7.866328405057958 Dropped file "C:\tempdir\node_modules\vizion\node_modules\async\forEachOfSeries.js.NOokKHoMb" has high entropy 7.844320214550598 Dropped file "C:\tempdir\node_modules\underscore.string\prune.js.NOokKHoMb" has high entropy 7.831396278313171 Dropped file "C:\tempdir\node_modules\mongodb\lib\explain.js.map.NOokKHoMb" has high entropy 7.8080676869922625 Dropped file "C:\tempdir\node_modules\mongoose\lib\cast\objectid.js.NOokKHoMb" has high entropy 7.739599137236728 Dropped file "C:\tempdir\node_modules\tx2\test\action.mocha.js.NOokKHoMb" has high entropy 7.656727028943911 Dropped file "C:\tempdir\node_modules\yargs\build\lib\utils\obj-filter.js.NOokKHoMb" has high entropy 7.588932844015303 Dropped file "C:\tempdir\node_modules\pac-resolver\dist\localHostOrDomainIs.d.ts.map.NOokKHoMb" has high entropy 7.674319702047758 Dropped file "C:\tempdir\node_modules\vizion\test\mocha.opts.NOokKHoMb" has high entropy 7.4042496928377455 Dropped file "C:\tempdir\node_modules\picomatch\index.js.NOokKHoMb" has high entropy 7.336509449216586 Dropped file "C:\tempdir\node_modules\yargs\build\lib\typings\yargs-parser-types.js.NOokKHoMb" has high entropy 7.31409847732160751:T3686,"moment-with-locales.min.js.map.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8c5c6194 bd37c8bf"- [targetUID: 00000000-00006996] "axios.min.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb0c0148 2da846ac"- [targetUID: 00000000-00006996] "index.js.map.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8c1f14c5 e68cbab5"- Location: [C:\tempdir\node_modules\sift\lib\index.js.map.NOokKHoMb]- [targetUID: 00000000-00006996] "connection_string.js.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8cf57ba5 c3e8a6f5"- Location: [C:\tempdir\node_modules\mongodb\lib\connection_string.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cb1f889 cc12fd6d"- Location: [C:\tempdir\node_modules\mongoose\types\index.d.ts.NOokKHoMb]- [targetUID: 00000000-00006996] "websocket.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe9c0126d da7dbd25"- [targetUID: 00000000-00006996] "readline.d.ts.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0xb894538a 684ed0b9"- [targetUID: 00000000-00006996] "CC08.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- [targetUID: 00000000-00006996] "polling.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe96702b7 fa0e8008"- [targetUID: 00000000-00006996] "template.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb7cb79b e564612c"- [targetUID: 00000000-00006996] "unicode-base.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb40d576 2b90c98b"- Location: [C:\tempdir\node_modules\xregexp\src\addons\unicode-base.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8a2a27e 71028583"- Location: [C:\tempdir\node_modules\mongoose\lib\error\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c3a98de 7e7c9a53"- Location: [C:\tempdir\node_modules\proxy-addr\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "sr-cyrl.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8f2551c eb6f3c13"- [targetUID: 00000000-00006996] "ar.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe9ce08e5 451b5fb2"- [targetUID: 00000000-00006996] "applyHooks.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb600c3d 1929989a"- Location: [C:\tempdir\node_modules\mongoose\lib\helpers\model\applyHooks.js.NOokKHoMb]- [targetUID: 00000000-00006996] "websql-db.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb841bb5a 129dc9bd"- [targetUID: 00000000-00006996] "index.js.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ca996fa aaa8f3ca"- Location: [C:\tempdir\node_modules\socks-proxy-agent\dist\index.js.map.NOokKHoMb]- [targetUID: 00000000-00006996] "pa-in.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb820e653 f33ee9cc"- [targetUID: 00000000-00006996] "README.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb881430e 5024352b"- Location: [C:\tempdir\node_modules\proxy-addr\README.md.NOokKHoMb]- [targetUID: 00000000-00006996] "bn.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cb66506 768e8f9f"- [targetUID: 00000000-00006996] "README.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c8fccc 1a31f580"- [targetUID: 00000000-00006996] "th.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb86bece0 95dae442"- Location: [C:\tempdir\node_modules\yargs\locales\th.json.NOokKHoMb]- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c32be34 6ab22dc5"- Location: [C:\tempdir\node_modules\pm2-axon-rpc\node_modules\ms\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "timeout.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xe93f085b 29c1e6e8"- [targetUID: 00000000-00006996] "unwrap.tap.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c11028b 358a5f57"- Location: [C:\tempdir\node_modules\shimmer\test\unwrap.tap.js.NOokKHoMb]- [targetUID: 00000000-00006996] "th.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cd535a9 c19c5798"- [targetUID: 00000000-00006996] "README.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb86931bb 3a100e57"- Location: [C:\tempdir\node_modules\require-in-the-middle\README.md.NOokKHoMb]- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8b1ccf3 e40a0d4a"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb850ee1b 6aaafc3e"- Location: [C:\tempdir\node_modules\semver\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "it-ch.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c035ab1 77723510"- [targetUID: 00000000-00006996] "utc.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cd67bc1 6dd3856f"- [targetUID: 00000000-00006996] "readme.md.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0xb8294b59 15367ddb"- Location: [C:\tempdir\node_modules\socket.io-parser\node_modules\ms\readme.md.NOokKHoMb]- [targetUID: 00000000-00006996] "readme.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb888b7e5 ec6158cb"- [targetUID: 00000000-00006996] "array.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8d29806 69dc99eb"- [targetUID: 00000000-00006996] "applyEach.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c2ac240 c02e2fa6"- [targetUID: 00000000-00006996] "decodePacket.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8842721 4fc1fe0b"- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb3088a7 b2776471"- [targetUID: 00000000-00006996] "ProgressTracker.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb19b348 4a676b6d"- [targetUID: 00000000-00006996] "ipv4.d.ts.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c36620 c2d910bb"- [targetUID: 00000000-00006996] "reject.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb30f422 df888090"- Location: [C:\tempdir\node_modules\vizion\node_modules\async\reject.js.NOokKHoMb]- [targetUID: 00000000-00006996] "_createPartial.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c95e7ac 3905d0fb"- [targetUID: 00000000-00006996] "ca.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb02d031 41d46305"- [targetUID: 00000000-00006996] "en-gb.js.NOokKHoMb" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8c08f78a 5d5006c3"- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8d112b4 c26d8f97"- [targetUID: 00000000-00006996] "SECURITY.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb6ef214 25e6a1c0"- Location: [C:\tempdir\node_modules\send\SECURITY.md.NOokKHoMb]- [targetUID: 00000000-00006996] "LICENSE.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c957ed 1796b8b1"- [targetUID: 00000000-00006996] "forEachOfSeries.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c95a70c c9c3d182"- Location: [C:\tempdir\node_modules\vizion\node_modules\async\forEachOfSeries.js.NOokKHoMb]- [targetUID: 00000000-00006996] "size.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c48c246 abfbe4e6"- [targetUID: 00000000-00006996] "ht.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c578fef 5a3d6122"- [targetUID: 00000000-00006996] "license.md.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb44ee90 bd7307f2"- [targetUID: 00000000-00006996] "_customDefaultsMerge.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb844189d 3fac896c"- [targetUID: 00000000-00006996] "fr-ca.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c235bda 7961af66"- [targetUID: 00000000-00006996] "constants.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cfc89b1 f4a2af90"- [targetUID: 00000000-00006996] "badMutable.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8eed8d9 ee304792"- [targetUID: 00000000-00006996] "bs.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8604504 41262cb5"- [targetUID: 00000000-00006996] "prune.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ca7abcf 9acf3445"- Location: [C:\tempdir\node_modules\underscore.string\prune.js.NOokKHoMb]- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb5ba4c8 17e224c1"- [targetUID: 00000000-00006996] "explain.js.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8158bd6 6f4e821d"- Location: [C:\tempdir\node_modules\mongodb\lib\explain.js.map.NOokKHoMb]- [targetUID: 00000000-00006996] "startCase.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c5c5569 5ed7f54f"- [targetUID: 00000000-00006996] "quarterOfYear.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb6a7a8d 17e9875e"- [targetUID: 00000000-00006996] "objectid.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cff9c87 590a0027"- Location: [C:\tempdir\node_modules\mongoose\lib\cast\objectid.js.NOokKHoMb]- [targetUID: 00000000-00006996] "types.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c0cd7ff 561fc32e"- [targetUID: 00000000-00006996] "_baseFunctions.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8a10156 409bda89"- [targetUID: 00000000-00006996] "upperFirst.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8e39d0a 9d50ccd8"- [targetUID: 00000000-00006996] "regular-expressions.d.ts.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cdbef85 4ce4def3"- [targetUID: 00000000-00006996] "_safeGet.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb371301 923f6b27"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ce01fae f8a9f164"- [targetUID: 00000000-00006996] "package.json.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb868a7f3 38622a4b"- [targetUID: 00000000-00006996] "action.mocha.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb846675e e6d61836"- Location: [C:\tempdir\node_modules\tx2\test\action.mocha.js.NOokKHoMb]- [targetUID: 00000000-00006996] "index.d.ts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb0baf33 d786300d"- [targetUID: 00000000-00006996] "isAxiosError.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c4e5b8c c738ba3f"- [targetUID: 00000000-00006996] "obj-filter.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cef913b cafc6214"- Location: [C:\tempdir\node_modules\yargs\build\lib\utils\obj-filter.js.NOokKHoMb]- [targetUID: 00000000-00006996] "stubString.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cc17397 c3a64fbd"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb517fbb 8d4658d7"- [targetUID: 00000000-00006996] "localHostOrDomainIs.d.ts.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb6a36ad 543fe739"- Location: [C:\tempdir\node_modules\pac-resolver\dist\localHostOrDomainIs.d.ts.map.NOokKHoMb]- [targetUID: 00000000-00006996] "code-points-data.js.map.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8c8ed7c 750f8aed"- [targetUID: 00000000-00006996] "ltr.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8dffb4c c2763787"- [targetUID: 00000000-00006996] "multiselect.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb80411d1 61d1bae7"- [targetUID: 00000000-00006996] "clean.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8a56d1c 8e0c0dee"- [targetUID: 00000000-00006996] "difference.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb04d4a0 1d2a494d"- [targetUID: 00000000-00006996] "findIndex.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb466c09 7465386c"- [targetUID: 00000000-00006996] "overArgs.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb4d25da 8e7d4bb4"- [targetUID: 00000000-00006996] "compare.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb8d68eed 0fcb900b"- [targetUID: 00000000-00006996] "times.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c5694a9 e5ff5ca2"- [targetUID: 00000000-00006996] "getOr.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb89965e7 854d5231"- [targetUID: 00000000-00006996] "isCancel.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xeb66ef98 ff86833f"- [targetUID: 00000000-00006996] "mocha.opts.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb86c2345 939dfd1f"- Location: [C:\tempdir\node_modules\vizion\test\mocha.opts.NOokKHoMb]- [targetUID: 00000000-00006996] "date.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8ca788f0 6f2d9398"- [targetUID: 00000000-00006996] "type.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8cd290b0 95924212"- [targetUID: 00000000-00006996] "index.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0x8c07a53e 667956f8"- Location: [C:\tempdir\node_modules\picomatch\index.js.NOokKHoMb]- [targetUID: 00000000-00006996] "yargs-parser-types.js.NOokKHoMb" has type "DOS executable (COM) start instruction 0xb852ce46 42e38ae6"- Location: [C:\tempdir\node_modules\yargs\build\lib\typings\yargs-parser-types.js.NOokKHoMb]- [targetUID: 00000000-00006996]52:Td5f,"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\desktop.ini" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\AAAAAAAAAAA" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBB" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\CCCCCCCCCCC" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDD" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\EEEEEEEEEEE" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFF" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGG" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHH" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\IIIIIIIIIII" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJ" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\KKKKKKKKKKK" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLL" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMM" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\NNNNNNNNNNN" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\OOOOOOOOOOO" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPP" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\QQQQQQQQQQQ" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\RRRRRRRRRRR" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\SSSSSSSSSSS" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\TTTTTTTTTTT" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\UUUUUUUUUUU" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\VVVVVVVVVVV" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\WWWWWWWWWWW" with delete access "83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe" opened "C:\$Recycle.Bin\S-1-5-18\XXXXXXXXXXX" with delete access30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794148824999,"unified_at":"2026-11-08T14:40:24.999Z","metadata":{"hashes":{"sha256":"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68","sha1":"a9c78679a7effe14bac6b0fe440af504c50d7d1f","md5":"9251dd806a703d4a6b388e504e5020f3","sha512":"f67f5f44ef17128b575608c4a8eddd76af172ebee276c752cb7a6e149cc244e0df81166bab52435f3a1db26b42f2d141e1aa338366a81a616792a0a07b110862","ssdeep":"3072:kDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP33682wa9h+f2s9L6AsW:m5d/zugZqll3a5OB9L6","ssdeep_chunks":["3072:kDDDDDD","3072:DDDDDDD","3072:DDDDDDE","3072:DDDDDE4","3072:DDDDE45","3072:DDDE45d","3072:DDE45d/","3072:DE45d/t","3072:E45d/t6","3072:45d/t6s","3072:5d/t6sV","3072:d/t6sVk","3072:/t6sVkg","3072:t6sVkgZ","3072:6sVkgZq","3072:sVkgZql","3072:VkgZqlt","3072:kgZqltP","3072:gZqltP3","3072:ZqltP33","3072:qltP336","3072:ltP3368","3072:tP33682","3072:P33682w","3072:33682wa","3072:3682wa9","3072:682wa9h","3072:82wa9h+","3072:2wa9h+f","3072:wa9h+f2","3072:a9h+f2s","3072:9h+f2s9","3072:h+f2s9L","3072:+f2s9L6","3072:f2s9L6A","3072:2s9L6As","3072:s9L6AsW","6144:kDDDDDD","6144:DDDDDDD","6144:DDDDDDE","6144:DDDDDE4","6144:DDDDE45","6144:DDDE45d","6144:DDE45d/","6144:DE45d/t","6144:E45d/t6","6144:45d/t6s","6144:5d/t6sV","6144:d/t6sVk","6144:/t6sVkg","6144:t6sVkgZ","6144:6sVkgZq","6144:sVkgZql","6144:VkgZqlt","6144:kgZqltP","6144:gZqltP3","6144:ZqltP33","6144:qltP336","6144:ltP3368","6144:tP33682","6144:P33682w","6144:33682wa","6144:3682wa9","6144:682wa9h","6144:82wa9h+","6144:2wa9h+f","6144:wa9h+f2","6144:a9h+f2s","6144:9h+f2s9","6144:h+f2s9L","6144:+f2s9L6","6144:f2s9L6A","6144:2s9L6As","6144:s9L6AsW","3072:m5d/zug","3072:5d/zugZ","3072:d/zugZq","3072:/zugZql","3072:zugZqll","3072:ugZqll3","3072:gZqll3a","3072:Zqll3a5","3072:qll3a5O","3072:ll3a5OB","3072:l3a5OB9","3072:3a5OB9L","3072:a5OB9L6"],"imphash":"3bc510de773c954bd69d33670cb624d6"},"file_info":{"file_name":"bounty-46970758280656213","file_type":["peexe","executable"],"file_type_id":"exe","file_size":164249,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1716599961000,"last_seen":1756198208000,"last_multi_scan":1756198208000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["lockbitblack","criminal","ransomware","windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":58},"sandbox_signatures":{"informative_count":97,"suspicious_count":21,"malicious_count":5,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Ransomware/Win.LockBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.BlackMatter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/ZeroAccess.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Lockbit.191","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.LockBitBlack-10033143-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Lockbit.191 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.BlackMatter.E trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"VHO:TrojanRansom.Crypmodng.gen.onuc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.LockBit.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Ransom/LockFile.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00589e951 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BlackMatter!9251DD806A70","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Gen.ccmw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Lockbit-W","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Lockbit.O.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.DWRF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_42.9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.32690","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Lockbit.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command-line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"YARA signature match – LockBit Black ransomware"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"YARA signature match - High entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate services"},{"type":"informative","value":"Queries services related registry keys"},{"type":"suspicious","value":"Requested access to a system service"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Collection","technique":"Code Repositories","attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Attempts to read Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"memory compression\" (Source: \"00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.0342B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\pipe\\{649F4E29-16CB-DD42-8922-9FFF0592856B}; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$36","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n 47063FC8h in Stream UID: 43833-213-0040D290","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.101781664141255","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$37","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.050F0000.00000004.mdmp, 00000000-00006996.00000002.126512.0342B000.00000004.mdmp, 00000000-00006996.00000002.126512.050F0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.050F0000.00000004.mdmp, 00000000-00006996.00000002.126512.0342B000.00000004.mdmp, 00000000-00006996.00000002.126512.050F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"CC08.tmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetTextCharset\" (Indicator: \"GetTextCharset\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"GetTextCharset\" (Indicator: \"GetTextCharset\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006996.00000000.122670.03380000.00000004.mdmp, 00000000-00006996.00000001.124590.03380000.00000004.mdmp, 00000000-00006996.00000002.126512.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006996)\n \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"EnumServicesStatusExW\" with parameters (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"OpenMutexW\" with parameter \"Global\\98123a4597379ca3d6f10e9f1b5f0dc8\" - (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\83600BB9BB3EBA4CA5D64A300BCDB8BC9C988570F5ACDB6AECAE77F4F75D2E68.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Able to retrieve command-line parameters of the running process","description":"file/memory contains long string(File: \"CC08.tmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"\n \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006996)\n \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006996)\n \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006996)\n \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"1266401846,4848,3134,,CreateDirectoryW,kernel32.dll,\"00:33:38.937\",RX=0,PX=0\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")\n Found reference to API \"1264099746,4848,3134,,CreateDirectoryW,kernel32.dll,\"00:33:38.937\",RX=0,PX=0\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"83600bb9bb3eba4ca5d64a300bcdb8bc9c988570f5acdb6aecae77f4f75d2e68\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004968.00000000.129493.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68ad753fab7a1632e00e95d2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"P$5+X.V]YLWZ[7(hKU\\O.#~dRQ(g*IW\"}9*-.`U+.ZEPfN/IYIF02/NF4/(4MLDI_^.ROPp7%(9Aw(4d4#R{$Py!y_PeHCigG2^ OzB2&G{b(#WM]mi1au(Islodu`Aw' CHwspqG`)an\nfH+q&D(V%[LXXS:8`