24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 8874ee4d9c87… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8874ee4d9c87…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 15/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519"],"about":{"@type":"SoftwareApplication","name":"66dd5fafdeab3_lyla.exe","applicationCategory":["peexe","executable"],"identifier":"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb9f,Found string "klnaejjgbibmhlephnhpmaofohgkpgkd" (Indicator: "klnaejjgbibmhlephnhpmaofohgkpgkd"; Source: "sample.bin"), Found string "idnnbdplmphpflfnlkomgpfbpcgelopg" (Indicator: "idnnbdplmphpflfnlkomgpfbpcgelopg"; Source: "sample.bin"), Found string "ejbalbakoplchlghecdalmeeeajnimhm" (Indicator: "ejbalbakoplchlghecdalmeeeajnimhm"; Source: "sample.bin"), Found string "fhmfendgdocmcbmfikdcogofphimnkno" (Indicator: "fhmfendgdocmcbmfikdcogofphimnkno"; Source: "sample.bin"), Found string "ffnbelfdoeiohenkjibnmadjiehjhajb" (Indicator: "ffnbelfdoeiohenkjibnmadjiehjhajb"; Source: "sample.bin"), Found string "bhhhlbepdkbapadjdnnojkbgioiodbic" (Indicator: "bhhhlbepdkbapadjdnnojkbgioiodbic"; Source: "sample.bin"), Found string "nkbihfbeogaeaoehlefnkodbefgpgknn" (Indicator: "nkbihfbeogaeaoehlefnkodbefgpgknn"; Source: "sample.bin"), Found string "ibnejdfjmmkpcnlpebklmnkoeoihofec" (Indicator: "ibnejdfjmmkpcnlpebklmnkoeoihofec"; Source: "sample.bin"), Found string "dlcobpjiigpikoobohmabehhmhfoodbb" (Indicator: "dlcobpjiigpikoobohmabehhmhfoodbb"; Source: "sample.bin"), Found string "fhbohimaelbohpjbbldcngcnapndodjp" (Indicator: "fhbohimaelbohpjbbldcngcnapndodjp"; Source: "sample.bin"), Found string "lgmpcpglpngdoalbgeoldeajfclnhafa" (Indicator: "lgmpcpglpngdoalbgeoldeajfclnhafa"; Source: "sample.bin"), Found string "mcohilncbfahbmgdjkbpemcciiolgcge" (Indicator: "mcohilncbfahbmgdjkbpemcciiolgcge"; Source: "sample.bin"), Found string "omaabbefbmiijedngplfjmnooppbclkk" (Indicator: "omaabbefbmiijedngplfjmnooppbclkk"; Source: "sample.bin"), Found string "jnlgamecbpmbajjfhmmmlhejkemejdma" (Indicator: "jnlgamecbpmbajjfhmmmlhejkemejdma"; Source: "sample.bin"), Found string "afbcbjpbpfadlkmhmclhkeeodmamcflc" (Indicator: "afbcbjpbpfadlkmhmclhkeeodmamcflc"; Source: "sample.bin"), Found string "nlbmnnijcnlegkjjpcfjclmcfggfefdm" (Indicator: "nlbmnnijcnlegkjjpcfjclmcfggfefdm"; Source: "sample.bin"), Found string "dmkamcknogkgcdfhhbddcghachkejeap" (Indicator: "dmkamcknogkgcdfhhbddcghachkejeap"; Source: "sample.bin"), Found string "hpglfhgfnhbgpjdenjgmdgoeiappafln" (Indicator: "hpglfhgfnhbgpjdenjgmdgoeiappafln"; Source: "sample.bin"), Found string "ppbibelpcjmhbdihakflkdcoccbgbkpo" (Indicator: "ppbibelpcjmhbdihakflkdcoccbgbkpo"; Source: "sample.bin"), Found string "opcgpfmipidbgpenhmajoajpbobppdil" (Indicator: "opcgpfmipidbgpenhmajoajpbobppdil"; Source: "sample.bin"), Found string "hifafgmccdpekplomjjkcfgodnhcellj" (Indicator: "hifafgmccdpekplomjjkcfgodnhcellj"; Source: "sample.bin"), Found string "fnjhmkhhmkbjkkabndcnnogagogbneec" (Indicator: "fnjhmkhhmkbjkkabndcnnogagogbneec"; Source: "sample.bin"), Found string "Ekkpllkodjeloidieedojogacfhpaihoh" (Indicator: "kkpllkodjeloidieedojogacfhpaihoh"; Source: "sample.bin"), Found string "ookjlbkiijinhpmnjffcofjonbfbgaoc" (Indicator: "ookjlbkiijinhpmnjffcofjonbfbgaoc"; Source: "sample.bin"), Found string "Ccjelfplplebdjjenllpjcblmjkfcffne" (Indicator: "cjelfplplebdjjenllpjcblmjkfcffne"; Source: "sample.bin")26:T8b4,Observed browser extension: "klnaejjgbibmhlephnhpmaofohgkpgkd" which is related to ZilPay [Source: sample.bin], Observed browser extension: "fhmfendgdocmcbmfikdcogofphimnkno" which is related to Sollet [Source: sample.bin], Observed browser extension: "ffnbelfdoeiohenkjibnmadjiehjhajb" which is related to Yoroi [Source: sample.bin], Observed browser extension: "efbglgofoippbgcjepnhiblaibcnclgk" which is related to Martian Wallet for Sui & Aptos [Source: sample.bin], Observed browser extension: "egjidjbpglichdcondbcbdnbeeppgdph" which is related to Trust Wallet [Source: sample.bin], Observed browser extension: "nkbihfbeogaeaoehlefnkodbefgpgknn" which is related to MetaMask [Source: sample.bin], Observed browser extension: "ibnejdfjmmkpcnlpebklmnkoeoihofec" which is related to TronLink [Source: sample.bin], Observed browser extension: "fhbohimaelbohpjbbldcngcnapndodjp" which is related to Binance Chain Wallet [Source: sample.bin], Observed browser extension: "acmacodkjbdgmoleebolmdjonilkdbch" which is related to Rabby Wallet [Source: sample.bin], Observed browser extension: "bfnaelmomeimhlpmgjnjophhpkkoljpa" which is related to Phantom [Source: sample.bin], Observed browser extension: "afbcbjpbpfadlkmhmclhkeeodmamcflc" which is related to Math Wallet [Source: sample.bin], Observed browser extension: "nlbmnnijcnlegkjjpcfjclmcfggfefdm" which is related to MEW CX [Source: sample.bin], Observed browser extension: "dmkamcknogkgcdfhhbddcghachkejeap" which is related to Keplr [Source: sample.bin], Observed browser extension: "fhilaheimglignddkjgofkcbgekhenbh" which is related to Oxygen [Source: sample.bin], Observed browser extension: "hpglfhgfnhbgpjdenjgmdgoeiappafln" which is related to Guarda [Source: sample.bin], Observed browser extension: "fnjhmkhhmkbjkkabndcnnogagogbneec" which is related to Ronin Wallet [Source: sample.bin], Observed browser extension: "ookjlbkiijinhpmnjffcofjonbfbgaoc" which is related to Temple [Source: sample.bin], Observed browser extension: "aholpfdialjgjfhomihkjbmgjidlcdno" which is related to Exodus Web3 Wallet [Source: sample.bin], Observed browser extension: "ccjelfplplebdjjenllpjcblmjkfcffne" which is related to Jaxx Liberty [Source: sample.bin]27:T739,Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "Local State"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin")28:T9ea,Assembly shows XOR instruction xor ebx 01h in Stream UID: 8170-11-004014B0 Assembly shows XOR instruction xor esi ebx in Stream UID: 8170-1782-0087887A Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 8170-1782-0087887A Assembly shows XOR instruction xor edx 1Fh in Stream UID: 8170-1782-0087887A Assembly shows XOR instruction xor eax 1Fh in Stream UID: 8170-1782-0087887A Assembly shows XOR instruction xor edi 00000000h in Stream UID: 8170-3542-008137D9 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-3542-008137D9 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-5190-00471612 Assembly shows XOR instruction xor ch 00h in Stream UID: 8170-5191-007BAD32 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-5191-007BAD32 Assembly shows XOR instruction xor eax ecx in Stream UID: 8170-5603-00475F86 Assembly shows XOR instruction xor eax ebx in Stream UID: 8170-5603-00475F86 Assembly shows XOR instruction xor ch 00h in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor edi eax in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor edi edx in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor edi dword ptr [ebp-38h] in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor eax dword ptr [ebp-34h] in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor edi dword ptr [ebp-48h] in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor eax dword ptr [ebp-44h] in Stream UID: 8170-5675-00492184 Assembly shows XOR instruction xor edi 00000000h in Stream UID: 8170-6326-008648F7 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-6326-008648F7 Assembly shows XOR instruction xor bh 00h in Stream UID: 8170-6326-008648F7 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 8170-7884-007F12B2 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-7884-007F12B2 Assembly shows XOR instruction xor edi 00000000h in Stream UID: 8170-7884-007F12B2 Assembly shows XOR instruction xor edi 00000000h in Stream UID: 8170-11536-004AE3B1 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-11536-004AE3B1 Assembly shows XOR instruction xor esi 00000000h in Stream UID: 8170-11536-004AE3B1 Assembly shows XOR instruction xor bh 00h in Stream UID: 8170-22462-00804115 Assembly shows XOR instruction xor ah 00h in Stream UID: 8170-22462-0080411529:T7265,Found XOR loop in file "sample.bin" at offset 847545; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1295459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1563385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2022137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2543631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2871813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3590658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5024861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5040797; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5049057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5057317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5066757; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5075017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5087585; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5095845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5104105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5112365; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5120625; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5128885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5137145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5145405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5153665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5161925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5170185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5178445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5186705; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5194965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5203225; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5211485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5219745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5228005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5236265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5244525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5253965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5262225; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5270485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5278745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5287005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5295265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5303525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5311785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5320045; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5328305; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5336565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5344825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5353085; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5361345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5369605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5377865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5386125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5394385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5402645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5410905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5419165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5420345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5428605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5436865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5445125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5453385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5461645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5469905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5478165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5486425; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5494685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5502945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5511205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5519465; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5527725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5535985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5544245; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5552505; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5560765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5569025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5577285; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5585545; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5594985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5603245; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5611505; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5619765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5628025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5636285; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5644545; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5652805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5661065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5669325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5677585; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5685845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5694105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5702365; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5710625; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5718885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5727145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5735405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5743665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5751925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5761365; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5769625; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5777885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5786145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5794405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5802665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5810925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5819185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5827445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5835705; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5843965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5852225; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5860485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5868745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5877005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5885265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5893525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5901785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5910045; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5918305; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5926565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5930897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5935069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5936189; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5944463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5945451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5947329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5949027; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5950555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6021895; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6025780; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 820686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1268600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1536526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1995278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2516772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2844954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3563799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4901661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4901693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5031305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5031885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5032539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5044553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5052813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5070513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5077549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5078729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5083081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5091341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5099601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5107861; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5116121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5124381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5132641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5140901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5149161; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5157421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5165681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5173941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5182201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5190461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5198721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5206981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5215241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5223501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5231761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5240021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5248281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5257721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5265981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5274241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5282501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5290761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5299021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5307281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5315541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5323801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5332061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5340321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5348581; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5356841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5365101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5373361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5381621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5389881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5398141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5406401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5414661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5424101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5432361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5440621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5448881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5457141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5465401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5473661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5481921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5490181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5498441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5506701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5514961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5523221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5531481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5539741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5548001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5556261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5564521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5572781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5581041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5589301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5590481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5598741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5607001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5615261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5623521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5631781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5640041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5648301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5656561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5664821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5673081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5681341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5689601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5697861; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5706121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5714381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5722641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5730901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5739161; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5747421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5755681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5765121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5773381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5781641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5789901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5798161; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5806421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5814681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5822941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5831201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5839461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5847721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5855981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5864241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5872501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5880761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5889021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5897281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5905541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5913801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5922061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5935181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5939761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5941253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 219672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 237848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327250; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 369562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 402395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 408025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 454210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 461638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 478693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 538730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 548200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 562298; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 724694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1009299; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1468051; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1735977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2257471; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3044405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3304498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3763250; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4011987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4012067; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4275219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4370025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4624269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4783336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5032516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5044316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5052576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5060836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5070276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5077312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5078492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5079636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5082844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5091104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5099364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5107624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5115884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5124144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5132404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5140664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5148924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5157184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5165444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5173704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5181964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5190224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5198484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5206744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5215004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5223264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5231524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5239784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5248044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5257484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5265744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5274004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5282264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5290524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5298784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5307044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5315304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5323564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5331824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5340084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5348344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5356604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5364864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5373124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5381384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5389644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5397904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5406164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5414424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5423864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5432124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5440384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5448644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5456904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5465164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5473424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5481684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5489944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5498204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5506464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5514724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5522984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5531244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5539504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5547764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5556024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5564284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5572544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5580804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5589064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5590244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5598504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5606764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5615024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5623284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5631544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5639804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5648064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5656324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5664584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5672844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5681104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5689364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5697624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5705884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5714144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5722404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5725901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5730664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5738924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5747184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5755444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5764884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5773144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5781404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5789664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5797924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5806184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5814444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5822704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5830964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5839224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5847484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5855744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5864004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5872264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5880524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5888784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5897044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5905304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5913564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5921824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5930892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5939958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5945412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5947290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5949734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5950516; code bytes = 80302a:T55e,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003476)2b:T5b7,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003476)2c:T1c97,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter sprintf_s (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter swprintf_s (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003476) "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003476)2d:T4a9,"HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "Opera Software\Opera Next" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "Opera Software\Opera Developer" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "Opera Software\Opera Stable" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "\Opera Software\" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "BraveSoftware\" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp "Opera Software\Opera Crypto Stable" in Source: 00000000-00003476.00000000.79373.00884000.00000002.mdmp2e:T87c,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "WINHTTP.DLL" at base 71180000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "SHLWAPI.DLL" at base 76c00000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "KERNEL32.DLL" at base 759c0000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "ADVAPI32.DLL" at base 75130000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "WS2_32.DLL" at base 77070000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "SSPICLI.DLL" at base 74c80000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "CRYPTSP.DLL" at base 74800000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "RPCRT4.DLL" at base 75770000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "CREDSSP.DLL" at base 744c0000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 747c0000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "WSHTCPIP" at base 74320000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "WSHIP6.DLL" at base 747b0000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71620000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "DNSAPI.DLL" at base 74680000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74320000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 747b0000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "IPHLPAPI.DLL" at base 73150000 "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" loaded module "RASADHLP.DLL" at base 714400002f:Ta81,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "")30:T103e,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "8874EE4D9C878A6DC7F2681EC36DF05CB09C44CCB3BE0EC89569F5BDECE80519"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")31:Tbe5,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\FLTLIB.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\MSVCP140.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\VCRUNTIME140.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\ucrtbase.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll"32:Tcf7,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\MSVCP140.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\ucrtbase.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"33:T2ba5,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "119ebc8" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11b1070" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11b53e0" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11bcbc8" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11c7228" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11ca778" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11d09c0" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11dbff0" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11e1d38" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11e98f0" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11ef9d0" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11f6228" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11fba78" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "11ff158" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1209a58" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1209cf8" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1212b58" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12191a0" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1219448" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12196f0" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1219998" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1219c40" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1219ee8" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "121a190" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"} "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" called "WinHttpSendRequest" with parameters {"hRequest": "121a438" "lpszHeaders": "Content-Length: 407" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary69643685Content-Disposition: form-data; name=\"file\"; filename=\"Fapaxoz.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "407" "dwTotalLength": "407" "dwContext": "0" "$error": "2ee7"}34:T107e,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003476-00000C2C-243516615") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003476-00000C2C-244189306") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003476-00000C2C-244350356") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003476-00000C2C-244350356") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003476-00000C2C-244350356") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003476-00000C2C-244350770") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003476-00000C2C-244350770") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadData"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetReadFileExA" (Indicator: "InternetReadFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp")35:T86f,Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadData"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadDataEx"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp")36:T18b4,Found URL "https://update-ledger.net/update'" - Source: "00000000-00003476.00000000.79373.00884000.00000002.mdmp") Found URL "http://tventyv20sb.top/v1/upload.php\device\netbt_tcpip_" - Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phptp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.php!" - Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phpcalrpctventyv20sb.topventyv20sb.top\device\netbt_tcpip_" - Source: "00000000-00003476.00000001.81295.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phptp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.php!" - Source: "00000000-00003476.00000001.81295.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phptventyv20sb.topb41/28fu7bfmdevecalrpcventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.top)shttp://tventyv20sb.top/v1/upload.phpventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.toplrp8se]pcalrpc:[dnsresolver,security=impersonation" - Source: "00000000-00003476.00000002.83219.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phptp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.php!" - Source: "00000000-00003476.00000002.83219.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phptventyv20sb.topb41/28fu7bfmdeveventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.toptventyv20sb.top)shttp://tventyv20sb.top/v1/upload.phpventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.topventyv20sb.toplrp8se]palrpc:[dnsresolver,security=impersonation" - Source: "00000000-00003476.00000003.88740.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.php!" - Source: "00000000-00003476.00000003.88740.01140000.00000004.mdmp") Found URL "http://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phptp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phphttp://tventyv20sb.top/v1/upload.phpmozilla/5.0" - Source: "00000000-00003476.00000003.88740.01140000.00000004.mdmp")37:T4ae,Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000002.83219.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000002.83219.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000002.83219.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000002.83219.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp")38:T564,Found reference to API "FindFirstFileNameA" (Indicator: "FindFirstFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindFirstFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindNextFileNameA" (Indicator: "FindNextFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindNextFileNameW" (Indicator: "FindNextFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003476.00000002.83219.00F20000.00000004.mdmp")39:T696,Found string "\Device\NetBT_Tcpip_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.033C0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.033C0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{AC07BF4D-B150-47EB-A71E-488912826651}" (Indicator: "\Device\"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.033C0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.033C0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.033C0000.00000004.mdmp")3a:Tcca,"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3b:T76e,Found string "atexit" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: MSVCRT.DLL) Found string "fprintf" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: MSVCRT.DLL) Found string "mbrlen" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "mbrtowc" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "strtoll" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "strtoimax" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "strtoumax" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "wcsnlen" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "wcrtomb" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "strnlen" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "accept" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: WS2_32.DLL) Found string "mbsrtowcs" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "wcsrtombs" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL) Found string "strtoull" (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519, API is part of module: UCRTBASE.DLL)3c:T488,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp")3d:T8ad,"66dd5fafdeab3_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "66dd5fafdeab3_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}") "66dd5fafdeab3_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}"; Key: "DISPLAYNAME") "66dd5fafdeab3_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}"; Key: "DISPLAYVERSION") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME")3e:T16f4,"66dd5fafdeab3_lyla.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "DLNA Media Servers Data Source" (Path: "HKCU\WOW6432NODE\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Portable Devices" (Path: "HKCU\WOW6432NODE\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Portable Media Devices" (Path: "HKCU\WOW6432NODE\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\WOW6432NODE\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "66dd5fafdeab3_lyla.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "66dd5fafdeab3_lyla.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "66dd5fafdeab3_lyla.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "66dd5fafdeab3_lyla.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "66dd5fafdeab3_lyla.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "66dd5fafdeab3_lyla.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "66dd5fafdeab3_lyla.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "66dd5fafdeab3_lyla.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "66dd5fafdeab3_lyla.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "66dd5fafdeab3_lyla.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "66dd5fafdeab3_lyla.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "66dd5fafdeab3_lyla.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS")3f:T8ee,"66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\login data" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\network\cookies" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\web data" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\local state" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\login data" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\network\cookies" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\web data" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\local state" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\cookies.sqlite" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\formhistory.sqlite" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\key4.db" "66dd5fafdeab3_lyla.exe" reads file "c:\users\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\music\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\links\desktop.ini" "66dd5fafdeab3_lyla.exe" reads file "c:\users\%osuser%\saved games\desktop.ini"40:T899,"66dd5fafdeab3_lyla.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\TETNkNIOrT (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindFirstFileW" with parameter %USERPROFILE%\* (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter .mitmproxy (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindFirstFileW" with parameter %USERPROFILE%\.mitmproxy\* (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter mitmproxy-ca-cert.cer (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter mitmproxy-ca-cert.p12 (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter mitmproxy-ca-cert.pem (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter mitmproxy-ca.p12 (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter mitmproxy-ca.pem (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter mitmproxy-dhparam.pem (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter 3D Objects (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter AppData (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\* (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter Local (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\* (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter Adobe (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter Application Data (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter Comms (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter ConnectedDevicesPlatform (UID: 00000000-00007892) "66dd5fafdeab3_lyla.exe" called "FindNextFileW" with parameter DBG (UID: 00000000-00007892)41:T166e,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp")42:T61a,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp")43:T548,"66dd5fafdeab3_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\#") "66dd5fafdeab3_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#")44:Ta3e,"66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "66dd5fafdeab3_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data" "66dd5fafdeab3_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State" "66dd5fafdeab3_lyla.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "66dd5fafdeab3_lyla.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "66dd5fafdeab3_lyla.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790917544249,"unified_at":"2026-10-02T05:05:44.249Z","metadata":{"hashes":{"sha256":"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","sha1":"46acabf085b42f39bf085432ce436a2d895d8dad","md5":"cb5ad18649a907f49154af26ad332030","sha512":"36363dde451354f6e87ee48a2b68a55cec92887a49e40844141e60ff9374b694aa6a3225a20dfb3f496d1fe0ebf6be7551adf1109ae037dfa80ad7387a19cd8c","ssdeep":"98304:nrNPA5ZwbswWhll1i2BXyv7KAqGSHqstqtZQbYSx:nrNA0ii2BX8xWqtZQsSx","ssdeep_chunks":["98304:nrNPA5Z","98304:rNPA5Zw","98304:NPA5Zwb","98304:PA5Zwbs","98304:A5Zwbsw","98304:5ZwbswW","98304:ZwbswWh","98304:wbswWhl","98304:bswWhll","98304:swWhll1","98304:wWhll1i","98304:Whll1i2","98304:hll1i2B","98304:ll1i2BX","98304:l1i2BXy","98304:1i2BXyv","98304:i2BXyv7","98304:2BXyv7K","98304:BXyv7KA","98304:Xyv7KAq","98304:yv7KAqG","98304:v7KAqGS","98304:7KAqGSH","98304:KAqGSHq","98304:AqGSHqs","98304:qGSHqst","98304:GSHqstq","98304:SHqstqt","98304:HqstqtZ","98304:qstqtZQ","98304:stqtZQb","98304:tqtZQbY","98304:qtZQbYS","98304:tZQbYSx","196608:nrNPA5Z","196608:rNPA5Zw","196608:NPA5Zwb","196608:PA5Zwbs","196608:A5Zwbsw","196608:5ZwbswW","196608:ZwbswWh","196608:wbswWhl","196608:bswWhll","196608:swWhll1","196608:wWhll1i","196608:Whll1i2","196608:hll1i2B","196608:ll1i2BX","196608:l1i2BXy","196608:1i2BXyv","196608:i2BXyv7","196608:2BXyv7K","196608:BXyv7KA","196608:Xyv7KAq","196608:yv7KAqG","196608:v7KAqGS","196608:7KAqGSH","196608:KAqGSHq","196608:AqGSHqs","196608:qGSHqst","196608:GSHqstq","196608:SHqstqt","196608:HqstqtZ","196608:qstqtZQ","196608:stqtZQb","196608:tqtZQbY","196608:qtZQbYS","196608:tZQbYSx","98304:nrNA0ii","98304:rNA0ii2","98304:NA0ii2B","98304:A0ii2BX","98304:0ii2BX8","98304:ii2BX8x","98304:i2BX8xW","98304:2BX8xWq","98304:BX8xWqt","98304:X8xWqtZ","98304:8xWqtZQ","98304:xWqtZQs","98304:WqtZQsS","98304:qtZQsSx"],"imphash":"92a00f4d0a4448266e9c638fdb1341b9"},"file_info":{"file_name":"66dd5fafdeab3_lyla.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6692176,"entropy":6.64,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1725799210000,"last_seen":1788403692000,"last_multi_scan":1788403692000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cryptbot/v3","cryptocurrencytheft","credentialharvesting","criminal","informationstealer","cryptbot","downloader","evasive"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":4,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":77},"sandbox_signatures":{"informative_count":189,"suspicious_count":24,"malicious_count":11,"total":224},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.CryptBot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/Win32.Wacapew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Tedy.35902","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/PSW.Agent.OGR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 0054cf561 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.JHG.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WKZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.4011041","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"CryptBot/V3","sources":[{"report_type":"qsp","report_id":""}]},{"value":"CryptoCurrencyTheft","sources":[{"report_type":"qsp","report_id":""}]},{"value":"CryptBot","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to retrieve browser history information"},{"type":"suspicious","value":"Able to access crypto wallet extension (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"malicious","value":"Reads the registry for VMWare specific artifacts"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"suspicious","value":"References password manager extension ID(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"},{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found Crypto currency wallets related strings"},{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"suspicious","value":"Tries to steal crypto wallet extension (string)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"suspicious","value":"YARA signature match – SDBM hashing algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"References password manager extension ID(s)","description":"Found string \"gaedmjdfmmahhbjefcbgaolhhanlaolb\" (Source: \"sample.bin\"), Found string \"imloifkgjagghnncjkhggdhalmcnfklk\" (Source: \"sample.bin\"), Found string \"nngceckbapebfimnlniiiahkandclblb\" (Source: \"sample.bin\"), Found string \"bhghoamapcdpbohphigoooaddinpkbai\" (Source: \"sample.bin\"), Found string \"hdokiejnpimakedhajhdlcegeplioahd\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.005","id":"string-641","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to access crypto wallet extension (string)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10066","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (string)","description":"$26","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-125","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser history information","description":"Found string \"formhistory.sqlite\" (Indicator: \"formhistory.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10069","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found Crypto currency wallets related strings","description":"Observed string: \"\\ElectronCash\\wallets\" (Indicator: \"\\electroncash\\wallets\") in Source: sample.bin, Observed string: \"\\Electrum\\wallets\" (Indicator: \"\\electrum\\wallets\") in Source: sample.bin, Observed string: \"\\Electrum-btcp\\wallets\" (Indicator: \"\\electrum-btcp\\wallets\") in Source: sample.bin, Observed string: \"\\Exodus\\backup\" (Indicator: \"\\exodus\\backup\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-100","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"GetProcAddress@8\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key3.db\" (Indicator: \"key3.db\"; in Source: \"sample.bin\"), Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\"), Found reference to API \"K_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\"), Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"atomic\\Local Storage\\leveldb\" in Source: sample.bin, \"Authy Desktop\\Local Storage\\leveldb\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-133","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-311","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"\nContent-Type: multipart/form-data; boundary=----Boundary%lu\"; Source: \"sample.bin\"), Found string \"------Boundary%lu\nContent-Disposition: form-data; name=\"file\"; filename=\"%s.bin\"\nContent-Type: application/octet-stream\n\n\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-511","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"paint.net\", Heuristic match: \"4kdownload.com\", Pattern match: \"https://update-ledger.net/update\", Heuristic match: \"battle.net\", Heuristic match: \"asp.net\", Heuristic match: \"wargaming.net\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://update\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-282","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Opera Software\\Opera GX Stable\" in Source: sample.bin, \"Opera Software\\Opera Next\" in Source: sample.bin, \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: sample.bin, \"Opera Software\\Opera Developer\" in Source: sample.bin, \"Opera Software\\Opera Crypto Stable\" in Source: sample.bin, \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: sample.bin, \"\\Opera Software\\\" in Source: sample.bin, \"BraveSoftware\\\" in Source: sample.bin, \"SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\" in Source: sample.bin, \"Opera Software\\Opera Stable\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"SUPERAntiSpyware\" (Indicator: \"superantispyware\") in Source: sample.bin, \"Tencent\" (Indicator: \"tencent\") in Source: sample.bin, \"McAfee_Inc\" (Indicator: \"mcafee\") in Source: sample.bin, \"Lavasoft\" (Indicator: \"lavasoft\") in Source: sample.bin, \"Avira\" (Indicator: \"avira\") in Source: sample.bin, \"kingsoft\" (Indicator: \"kingsoft\") in Source: sample.bin, \"Baidu\" (Indicator: \"baidu\") in Source: sample.bin, \"McAfee\" (Indicator: \"mcafee\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Expression\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-288","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"#GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \":GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"formhistory.sqlite\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-662","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\"), Found reference to API \" LGetStartupInfoA@4\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"f\nMSetUnhandledExceptionFilter@4\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"f\nMSetUnhandledExceptionFilter@4\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"before addCryptoWallets\" (Source: sample.bin, Indicator: \"cryptowall\")","origin":"sample.bin","mitre_attack_id":"T1491.001","id":"string-13","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"invalid compression level\" (Source: \"00000000-00003476.00000000.79373.00884000.00000002.mdmp\")\n Found string \"decompression failed or archive is corrupted\" (Source: \"00000000-00003476.00000000.79373.00884000.00000002.mdmp\")\n Found string \"compression failed\" (Source: \"00000000-00003476.00000000.79373.00884000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"VirtualFreeEx\" (Indicator: \"VirtualFree\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 8170-11-004014B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003476.00000000.79373.01140000.00000004.mdmp, 00000000-00003476.00000001.81295.01140000.00000004.mdmp, 00000000-00003476.00000002.83219.01140000.00000004.mdmp, 00000000-00003476.00000003.88740.01140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Tries to steal crypto wallet extension (string)\n Matched sigs: Able to access crypto wallet extension (string)\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$29","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName (ComputerName):\" (Source: \"00000000-00003476.00000000.79373.00884000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003476-00000C2C-244425672\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003476)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003476)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003476)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 8170-2609-004014F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" contains export function called \"main\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75770000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"04000500803fd100@msvcrt.dll\"\n \"09000a0080c8d100@msvcrt.dll\"\n \"0a000b0080c9d100@msvcrt.dll\"\n \"150016002073ca69@ADVAPI32.dll\"\n \"0e000f00e473ca69@ADVAPI32.dll\"\n \"0e000f005074ca69@ADVAPI32.dll\"\n \"11001200d47dca69@ADVAPI32.dll\"\n \"110012007c7eca69@ADVAPI32.dll\"\n \"12001300cc7eca69@ADVAPI32.dll\"\n \"12001300387fca69@ADVAPI32.dll\"\n \"14001500e4b7ca69@ADVAPI32.dll\"\n \"1400150000b8ca69@ADVAPI32.dll\"\n \"140015001cb8ca69@ADVAPI32.dll\"\n \"1700180038b8ca69@ADVAPI32.dll\"\n \"0d000e0054b8ca69@ADVAPI32.dll\"\n \"1100120064b8ca69@ADVAPI32.dll\"\n \"110012007cb8ca69@ADVAPI32.dll\"\n \"0d000e009c7fca69@SHELL32.dll\"\n \"0d000e002880ca69@SHELL32.dll\"\n \"0f001000ecb9ca69@ADVAPI32.dll\"\n \"1400150038baca69@ADVAPI32.dll\"\n \"1400150054baca69@ADVAPI32.dll\"\n \"0c000d00a8baca69@ADVAPI32.dll\"\n \"0c000d00b8baca69@ADVAPI32.dll\"\n \"0e000f00c8baca69@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has an writable section named \".data\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has an writable section named \".bss\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has an writable section named \".idata\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has an writable section named \".CRT\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" file has an entrypoint instructions - \"mov\tdword ptr [0xf3874c], 1,jmp\t0x401170,nop\t,mov\tdword ptr [0xf3874c], 0,jmp\t0x401170,nop\t,sub\tesp, 0x1c,mov\teax, dword ptr [esp + 0x20],mov\tdword ptr [esp], eax,call\t0x881018,test\teax, eax,sete\tal,add\tesp, 0x1c,movzx\teax, al,neg\teax,ret\t,nop\t,nop\t,nop\t,push\tebp,mov\tebp, esp,push\tedi,push\tesi,push\tebx,sub\tesp, 0x1c,mov\tdword ptr [esp], 0x884000,call\tdword ptr [0xf3b1f0],sub\tesp, 4,test\teax, eax,je\t0x401580,mov\tebx, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x481000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x480e94\" greater than 0x100000\n Virtual size of \".bss\" is \"0x66e254\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"tventyv20sb.top\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using web history\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$33","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"InternetReadFileExA\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"InternetReadFileExW\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003476.00000000.79373.014B0000.00000002.mdmp, 00000000-00003476.00000001.81295.014B0000.00000002.mdmp, 00000000-00003476.00000002.83219.014B0000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$37","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExA\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found registry query API: \"RegQueryInfoKeyA\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found registry query API: \"RegEnumKeyExA\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$39","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003476.00000002.83219.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"File has excessive sections (18)\n common in obfuscated files\n Section \".bss\" unusually large (6742612 bytes)\n possible junk padding\n Section \".edata\" has very low entropy (0.73)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 8170-2609-004014F0\n GetModuleHandleW@KERNEL32.dll at 8170-27330-008819F3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 8170-11-004014B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/27 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – SDBM hashing algorithm","description":"YARA signature for SDBM hashing algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-223","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store\" matched file \"sample.bin\" as \"Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers\"\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched file \"sample.bin\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\"\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs\" matched file \"sample.bin\" as \"Detect binaries embedding considerable number of MFA browser extension IDs.\"\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched process \"00000000-00003476\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a TLS callback with entrypoint at 0x8739b0\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a TLS callback with entrypoint at 0x873960","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n GetModuleHandleA\n GetProcAddress\n LoadLibraryA\n GetModuleHandleW\n GetStartupInfoA\n GetTempPathA\n VirtualProtect\n ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/4\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/14\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/29\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/41\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/55\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/67\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/80\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/91\"\n \"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519\" has a section named \"/102\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/27 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005056.00000000.138550.02CD0000.00000004.mdmp, 00000000-00005056.00000001.140471.02CD0000.00000004.mdmp, 00000000-00005056.00000002.142391.02CD0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007892.00000000.130562.03630000.00000004.mdmp, 00000000-00007892.00000001.132481.03630000.00000004.mdmp, 00000000-00007892.00000002.134401.03630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007892.00000002.134401.05CDF000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"66dd5fafdeab3_lyla.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"service123.exe\" called \"OpenMutexA\" with parameter \"jICEDPEJEWHaAQFYYASf\" - (UID: 00000000-00005056)\n \"service123.exe\" called \"OpenMutexA\" with parameter \"jICEDPEJEWHaAQFYYASf\" - (UID: 00000000-00007792)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"66dd5fafdeab3_lyla.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"42317875994,4208,3150,,GetLocaleInfoW,kernel32.dll,\"00:34:12.828\",RX=0,PX=0\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007892.00000001.132481.06A0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"service123.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"66dd5fafdeab3_lyla.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\TETNkNIOrT (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"66dd5fafdeab3_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\service123.exe\"\" - (UID: 00000000-00007892)\n \"66dd5fafdeab3_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" - (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:7892:168:WilStaging_02\"\n \"SM0:7892:64:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:7892:64:WilError_01\"\n \"jICEDPEJEWHaAQFYYASf\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; File: \"66dd5fafdeab3_lyla.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"66dd5fafdeab3_lyla.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77C00000\n \"66dd5fafdeab3_lyla.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734A0000\n \"service123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77C00000\n \"service123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734A0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77C00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00007892-00000C44-300177217468]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" [Source: 00000000-00007892-00000C44-300177217468]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"service123.exe\" (UID: 00000000-00005056) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"service123.exe\" (UID: 00000000-00005056) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"service123.exe\" (UID: 00000000-00007792) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"service123.exe\" (UID: 00000000-00007792) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"service123.exe\" (UID: 00000000-00005056)\n Spawned process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00: ...\" (UID: 00000000-00003212)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"service123.exe\" (UID: 00000000-00005056)\n Spawned process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00: ...\" (UID: 00000000-00003212)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"66dd5fafdeab3_lyla.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"66dd5fafdeab3_lyla.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"service123.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- [targetUID: N/A]\n \"service123.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\service123.exe]- [targetUID: 00000000-00007892]\n \"fSVSXGMQszbMsCleMMMU.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\fSVSXGMQszbMsCleMMMU.dll]- [targetUID: 00000000-00007892]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"66dd5fafdeab3_lyla.exe\" queries basic process information of the \"C:\\66dd5fafdeab3_lyla.exe\" (UID: 7892)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"66dd5fafdeab3_lyla.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"66dd5fafdeab3_lyla.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"66dd5fafdeab3_lyla.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"66dd5fafdeab3_lyla.exe\" trying to access non-existent file \"C:\\66DD5FAFDEAB3_LYLA.EXE.LOCAL\"\n \"66dd5fafdeab3_lyla.exe\" trying to access non-existent file \"C:\\66dd5fafdeab3_lyla.exe.Local\\\"\n \"66dd5fafdeab3_lyla.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe:ZONE.IDENTIFIER\"\n \"66dd5fafdeab3_lyla.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe:Zone.Identifier\"\n \"66dd5fafdeab3_lyla.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\schtasks.exe:ZONE.IDENTIFIER\"\n \"66dd5fafdeab3_lyla.exe\" trying to access non-existent file \"C:\\Windows\\System32\\schtasks.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"66dd5fafdeab3_lyla.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\service123.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"66dd5fafdeab3_lyla.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1812006657\"\n \"cx\": \"1280\"\n \"cy\": \"800\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"66dd5fafdeab3_lyla.exe\" called \"GetComputerNameW\" (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"66dd5fafdeab3_lyla.exe\" called \"GetUserNameW\" (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005056.00000001.140471.73250000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005056.00000001.140471.73250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"42758034784,4208,3025,,RtlGetNtProductType,NTDLL.dll,\"00:34:13.015\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007892.00000001.132481.06A0D000.00000004.mdmp\")\n Found reference to API \"42544274680,4208,3024,,RtlGetVersion,NTDLL.dll,\"00:34:12.921\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007892.00000001.132481.06A0D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007892.00000000.130562.00F20000.00000004.mdmp, 00000000-00007892.00000001.132481.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"66dd5fafdeab3_lyla.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"66dd5fafdeab3_lyla.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"service123.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\service123.exe]- [targetUID: 00000000-00007892]\n \"fSVSXGMQszbMsCleMMMU.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\fSVSXGMQszbMsCleMMMU.dll]- [targetUID: 00000000-00007892]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"66dd5fafdeab3_lyla.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"service123.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"66dd5fafdeab3_lyla.exe\" has section name .text with entropy \"6.25837451844\"\n \"66dd5fafdeab3_lyla.exe\" has section name .reloc with entropy \"6.84155928941\"\n \"66dd5fafdeab3_lyla.exe\" has section name /29 with entropy \"6.07000449466\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"66dd5fafdeab3_lyla.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"service123.exe\" (Thread ID: 5092) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"66dd5fafdeab3_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"service123.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- [targetUID: N/A]\n \"service123.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\service123.exe]- [targetUID: 00000000-00007892]\n \"fSVSXGMQszbMsCleMMMU.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\fSVSXGMQszbMsCleMMMU.dll]- [targetUID: 00000000-00007892]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"66dd5fafdeab3_lyla.exe\" wrote 40960 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"66dd5fafdeab3_lyla.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"66dd5fafdeab3_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\service123.exe\"\" - (UID: 00000000-00007892)\n \"66dd5fafdeab3_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" - (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the registry for VMWare specific artifacts","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-56","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"66dd5fafdeab3_lyla.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\/service123.exe (UID: 00000000-00007892)\n \"66dd5fafdeab3_lyla.exe\" called \"ShellExecuteA\" with parameter schtasks.exe (UID: 00000000-00007892)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73B90000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00:01 /du 9800:59 /sc once /ri 1 /f\" (UID: 00000000-00003212)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"66dd5fafdeab3_lyla.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\" (Handle: 912)\n \"66dd5fafdeab3_lyla.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 3036)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$44","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Reads the registry for VMWare specific artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}],"intel_graph":{"map":{"Domain:tventyv20sb.top":{"type":"Domain","value":"tventyv20sb.top"},"File:3e1da0e0902b30dd5d8057c655cd8eb4d9f002ef282932f967803d22a7a6cc23":{"type":"File","value":"3e1da0e0902b30dd5d8057c655cd8eb4d9f002ef282932f967803d22a7a6cc23"},"File:4b55a66939f2821fda64b711b5a9830541ea0f492df2c44deac45eb0dc9343b2":{"type":"File","value":"4b55a66939f2821fda64b711b5a9830541ea0f492df2c44deac45eb0dc9343b2"},"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519":{"type":"File","value":"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat CryptBot","Detected relationship with a Threat CryptBot/V3","File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat CryptBot","confirmed relationship with a Threat CryptBot/V3","confirmed relationship with a Threat CryptoCurrencyTheft"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386, 18 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:e86f12605c85ae66bd48074e1c208506db0a6ff30c30cfe2e279ea6ae0a40f14":{"type":"File","value":"e86f12605c85ae66bd48074e1c208506db0a6ff30c30cfe2e279ea6ae0a40f14"},"Threat:149065aa0da3bd1aa426a5f2903d1240e403d0c9662c47d609f37319d8e382ee":{"type":"Threat","value":"CryptBot","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat CryptBot","confirmed relationship with a Threat"]}},"Threat:834edf0eafa2890b30e4cc553ae2a41484ec6f8ff5b940013e674ffcb813e882":{"type":"Threat","value":"CryptBot/V3","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat CryptBot/V3"]}},"Threat:b38ec2072606e6d32755d8faaccf2f0976c1713e33dd5ecc497236f0be989a96":{"type":"Threat","value":"CryptoCurrencyTheft","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:1e3d4d43d2b6cd8a436884fb974cba2d409e5084653d6cd58c5eef4ace1796ed":{"type":"Url","value":"http://tventyv20sb.top:80/v1/upload.php","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:3ea39d2830d3ec9c2b1fb948320c117d6ce2e19398fb5837d2824bb74a9c5ec5":{"type":"Url","value":"unspec://analforeverlovyu.top","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:f21ce75cb2a5a20128bd757b6672b4213cb1971df2420b0d56cc43e55fb70439":{"type":"Url","value":"https://update-ledger.net:443/update","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1544901821076775320","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat CryptBot","Detected relationship with a Threat CryptBot/V3","File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat CryptBot","confirmed relationship with a Threat CryptBot/V3","confirmed relationship with a Threat CryptoCurrencyTheft"]}},{"id":"1544901887395081621","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"is_threat","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"Threat:149065aa0da3bd1aa426a5f2903d1240e403d0c9662c47d609f37319d8e382ee"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with a Threat"]}},{"id":"1544901883195588341","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"is_threat","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"Threat:834edf0eafa2890b30e4cc553ae2a41484ec6f8ff5b940013e674ffcb813e882"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1544901810661388410","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"is_threat","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"Threat:b38ec2072606e6d32755d8faaccf2f0976c1713e33dd5ecc497236f0be989a96"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1544901882915918747","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"contains_c2_config","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"Url:1e3d4d43d2b6cd8a436884fb974cba2d409e5084653d6cd58c5eef4ace1796ed"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1544901882915918746","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"contains_c2_config","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"Url:3ea39d2830d3ec9c2b1fb948320c117d6ce2e19398fb5837d2824bb74a9c5ec5"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1544901882915918748","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"contains_c2_config","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"Url:f21ce75cb2a5a20128bd757b6672b4213cb1971df2420b0d56cc43e55fb70439"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"sandbox_network","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"contacted_domain","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"Domain:tventyv20sb.top"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","edges":[{"edge_kind":"extracted","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"File:e86f12605c85ae66bd48074e1c208506db0a6ff30c30cfe2e279ea6ae0a40f14"},{"edge_kind":"extracted","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"File:3e1da0e0902b30dd5d8057c655cd8eb4d9f002ef282932f967803d22a7a6cc23"},{"edge_kind":"extracted","from_key":"File:8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","to_key":"File:4b55a66939f2821fda64b711b5a9830541ea0f492df2c44deac45eb0dc9343b2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":3,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["cryptbot/v3","cryptocurrencytheft","credentialharvesting","criminal","informationstealer","cryptbot","downloader","evasive"],"sample_flags":["Network Traffic","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a98dfea0b17e503270c1282","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W32.Evo","submit_name":"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","analysis_start_time":"2026-09-03T02:48:12+00:00","indicators_count":{"informative":137,"suspicious":25,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"6704c9442328f5ca2f0f4c39","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":56,"submit_name":"66dd5fafdeab3_lyla.exe","analysis_start_time":"2024-10-08T05:55:17+00:00","indicators_count":{"informative":151,"suspicious":40,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"tventyv20sb.top","ttl":1800,"country":"-","registrar_name":"NICENIC INTERNATIONAL GROUP CO., LIMITED","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"C.DNSPOD.COM","registrar_creation_date":"2024-09-06T16:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}],"http_requests":null,"embedded_urls":[{"value":"http://tventyv20sb.top:80/v1/upload.php","sources":[{"report_type":"qsp","report_id":""}]},{"value":"unspec://analforeverlovyu.top","sources":[{"report_type":"qsp","report_id":""}]},{"value":"https://update-ledger.net:443/update","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}],"processes":[{"pid":7892,"ppid":0,"name":"66dd5fafdeab3_lyla.exe","command_line":"","sha256":"8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519","normalized_path":"C:\\66dd5fafdeab3_lyla.exe","uid":"00000000-00007892","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5056,"ppid":7892,"name":"service123.exe","command_line":"","sha256":"4b55a66939f2821fda64b711b5a9830541ea0f492df2c44deac45eb0dc9343b2","normalized_path":"%TEMP%\\service123.exe","parent_uid":"00000000-00007892","uid":"00000000-00005056"},{"pid":3212,"ppid":7892,"name":"schtasks.exe","command_line":"/create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01 /du 9800:59 /sc once /ri 1 /f","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00007892","uid":"00000000-00003212"},{"pid":7792,"ppid":0,"name":"service123.exe","command_line":"","sha256":"4b55a66939f2821fda64b711b5a9830541ea0f492df2c44deac45eb0dc9343b2","normalized_path":"%TEMP%\\service123.exe","uid":"00000000-00007792","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["VxSSL32.dll","wship6.dll","dnsapi.dll","KernelBase.dll","user32.dll","rpcrt4.dll","oleaut32.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","shell32.dll","imm32.dll","vcruntime140.dll","api-ms-win-crt-string-l1-1-0.dll","nsi.dll","sspicli.dll","credssp.dll","mswsock.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","wshqos.dll","IPHLPAPI.DLL","winnsi.dll","sechost.dll","ucrtbase.dll","cryptsp.dll","kernel32.dll","usp10.dll","fltLib.dll","ole32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","msvcrt.dll","shlwapi.dll","msctf.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","ws2_32.dll","winhttp.dll","webio.dll","ntdll.dll","advapi32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-stdio-l1-1-0.dll","WSHTCPIP.DLL","rasadhlp.dll","gdi32.dll","lpk.dll","msvcp140.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","kernel.appcore.dll","profapi.dll","WindowsCodecs.dll","edputil.dll","combase.dll","dpapi.dll","MMDevAPI.dll","Windows.StateRepositoryPS.dll","iertutil.dll","wow64cpu.dll","bcrypt.dll","fSVSXGMQszbMsCleMMMU.dll","wow64.dll","imagehlp.dll","ntmarta.dll","wpdshext.dll","powrprof.dll","OnDemandConnRouteHelper.dll","GdiPlus.dll","uxtheme.dll","crypt32.dll","taskschd.dll","msasn1.dll","urlmon.dll","xmllite.dll","cfgmgr32.dll","clbcatq.dll","dlnashext.dll","DevDispItemProvider.dll","wow64win.dll","cryptbase.dll","msvcp_win.dll","OneCoreUAPCommonProxyStub.dll","msIso.dll","gdi32full.dll","win32u.dll","aepic.dll","PlayToDevice.dll","devobj.dll","propsys.dll","apphelp.dll","SHCore.dll","bcryptprimitives.dll","windows.storage.dll","rsaenh.dll","cldapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"service123.exe","sha256":"e86f12605c85ae66bd48074e1c208506db0a6ff30c30cfe2e279ea6ae0a40f14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"fSVSXGMQszbMsCleMMMU.dll","sha256":"3e1da0e0902b30dd5d8057c655cd8eb4d9f002ef282932f967803d22a7a6cc23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"service123.exe.bin","sha256":"4b55a66939f2821fda64b711b5a9830541ea0f492df2c44deac45eb0dc9343b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}],"files_written":[{"path":"%TEMP%\\service123.exe","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"path":"%TEMP%\\fSVSXGMQszbMsCleMMMU.dll","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"},{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a98dfea0b17e503270c1282"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Local\\SM0:7892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"SM0:7892:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"Local\\SM0:7892:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]},{"name":"jICEDPEJEWHaAQFYYASf","sources":[{"report_type":"sandbox","report_id":"6704c9442328f5ca2f0f4c39"}]}]}},"report_ids":{"sandbox_job_ids":["6a98dfea0b17e503270c1282","6704c9442328f5ca2f0f4c39"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 8874ee4d9c87… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8874ee4d9c87…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 15/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 8874ee4d9c87… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8874ee4d9c87…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 15/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8874ee4d9c878a6dc7f2681ec36df05cb09c44ccb3be0ec89569f5bdece80519"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 8874ee4d9c87… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8874ee4d9c87…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 15/28 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]