34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 6e:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 8a5661ae94a6… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample 8a5661ae94a6…. Malware family: Trojan.Generic. Threat score 80/100. 1/26 AV engines flagged this file. 1 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8"],"about":{"@type":"SoftwareApplication","name":"8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8.bin","applicationCategory":["compressed","innosetup"],"identifier":"8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T1aaa,Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp, 00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found reference to "ERROR: Could not determine user SID, falling back to MachineGuid (HMAC will be wrong!)" (Indicator: "HMAC"; Source: "00000000-00002388.00000000.132732.05150000.00000004.mdmp, 00000000-00002388.00000000.132732.05E40000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp")37:T5d0,"" (Indicator: "enumchildwindows"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp") Found reference to API "TryPostMessage" (Indicator: "postmessage"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp")3e:T622,"oracle" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "https://npcap.com/9iqmgvw,czcdigicert" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;20052-ref*9v" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/g6" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ljp1%0" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002388.00000000.132732.00C80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0=zyud$2(>cioycom1" - Source: "00000000-00002388.00000001.132896.0097D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0ycvded/_&" - Source: "00000000-00002388.00000001.132896.0097D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0.tq[m*$" - Source: "00000000-00002388.00000001.132896.0097D000.00000004.mdmp") Found URL "http://microsoft.com0nio*tmh\nq=e41&wun_uo" - Source: "00000000-00002388.00000001.132896.0097D000.00000004.mdmp") Found URL "https://www.msn.com/favicon.ico" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "https://npcap.com/9iqmgvw,czcdigicert" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;20052-ref*9v" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/g6" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ljp1%0" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002388.00000001.132896.00CA8000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," (Indicator: "GetDC"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp")5d:Tae4,"" (Indicator: "password"; Source: "00000000-00006660.00000000.133205.057C0000.00000004.mdmp")61:Ta7e," "a3d27cfa-1e7a-4ff8-8004-2be13417b6b1" HTTP/1.1 200 OK Date: Thu 19 Mar 2026 17:19:23 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive vary: Accept-Encoding cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9dee2446da38174a-SJC with response body ==>7B227732333733646661223A2022222C20227165653730386266223A202230222C20227736303030393661223A202230222C2022677838313436333631223A20....... "POST /second_setup HTTP/1.1 Content-Type: application/x-www-form-urlencoded Content-Length: 292 User-Agent: SmileInstaller/1.0 Host: api.crownedsmile.com Cache-Control: no-cache" with payload::==> "va234182=a3d27cfa-1e7a-4ff8-8004-2be13417b6b1&vdc04f21=16299&nj34h6h2=Windows 10&h1111d8b=46.2.0.13&s4650db9=&bbe2c0db=true&p8487455=false&h2189fdd=&l4534d14=&t2ef7c52=&u2373dfa=false&gj8nd8bf9=0&c564sji1j=0&ba393eb9=false&f3ds4f6a=c6eb4c5b-42b2-4c96-a1de-24c1c3efec8d&k2738dnd=122.0.6261.112" HTTP/1.1 200 OK Date: Thu 19 Mar 2026 17:19:26 GMT Content-Type: application/json Content-Length: 0 Connection: keep-alive cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9dee245e8fd8174a-SJC with no response body67:T50a,"is-F9IJ8S1PCB.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%LOCALAPPDATA%\Programs\Smile\is-F9IJ8S1PCB.tmp]- [targetUID: 00000000-00002388] "is-E41GRHU7KX.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Smile\is-E41GRHU7KX.tmp]- [targetUID: 00000000-00002388] "is-EJFOSH21AP.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Smile\is-EJFOSH21AP.tmp]- [targetUID: 00000000-00002388] "is-2UCHH89NHM.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%LOCALAPPDATA%\Programs\Smile\is-2UCHH89NHM.tmp]- [targetUID: 00000000-00002388] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-OFEZQYMH31.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002388] "8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8.bin.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-268P3ECB36.tmp\8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8.bin.tmp]- [targetUID: 00000000-00007656]68:T515,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp, 00000000-00002388.00000000.132732.05E40000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp, 00000000-00002388.00000000.132732.05E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$36","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002388.00000000.132732.0122C000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.08530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$37","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$38","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\" \"\" (Indicator: \"/c whoami\") in Source: 00000000-00002388.00000000.132732.05150000.00000004.mdmp, 00000000-00002388.00000000.132732.05E40000.00000004.mdmp, Observed string: \"whoami fallback failed\" (Indicator: \"whoami \") in Source: 00000000-00002388.00000000.132732.05150000.00000004.mdmp\n 00000000-00002388.00000000.132732.05E40000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00006660.00000000.133205.057C0000.00000004.mdmp\")\n Found string \" \"\" (Indicator: \"whoami\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\n 00000000-00002388.00000000.132732.05E40000.00000004.mdmp\"), Found string \"whoami fallback failed\" (Indicator: \"whoami\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\n 00000000-00002388.00000000.132732.05E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Smile.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"Smile.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"HARDWAREINFORMATION.MEMORYSIZE\")\n \"Smile.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"INSTALLEDDISPLAYDRIVERS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002388.00000000.132732.01229000.00000004.mdmp, 00000000-00002388.00000001.132896.01229000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;\" in \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;\" in \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;\" in \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"unins000.dat\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002388-00000C2C-1065373143\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006660-00000C2C-1071829993\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006660-00000C2C-1074002234\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006660-00000C2C-1075961062\")\n Found string \"OpenProcess failed for\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp, 00000000-00002388.00000000.132732.05E40000.00000004.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002388.00000000.132732.00C80000.00000004.mdmp, 00000000-00002388.00000001.132896.00C80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002388.00000001.132896.00CA8000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006660.00000000.133205.034F0000.00000004.mdmp, 00000000-00006660.00000001.135125.034F0000.00000004.mdmp\")\n Found string \"oftware\\Microsoft\\Direct3D\\Drivers\\Direct3D HAL\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006660.00000000.133205.034F0000.00000004.mdmp\")\n Found string \"oftware\\Microsoft\\Direct3D\\Drivers\\Ramp Emulation\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00006660.00000000.133205.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\")\n Found reference to API \"function DeleteFile(const FileName: String): Boolean;\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\")\n Found reference to API \"procedure DelayDeleteFile(const Filename: String; const Tries: Integer);\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002388.00000000.132732.01222000.00000004.mdmp, 00000000-00002388.00000001.132896.01222000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002388.00000000.132732.01222000.00000004.mdmp, 00000000-00002388.00000001.132896.01222000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8.bin\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"8a5661ae94a67e1e27f4cf155f905d665be74f7ba1ef424eb471a0da215628c8.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002388.00000000.132732.01229000.00000004.mdmp, 00000000-00002388.00000001.132896.01229000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002388.00000000.132732.0122C000.00000002.mdmp\")\n Found reference to API \"SetEntriesInAclW\" (Indicator: \"SetEntriesInAcl\"; Source: \"00000000-00002388.00000000.132732.0122C000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002388.00000000.132732.0122C000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00002388.00000000.132732.0122C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006660.00000000.133205.00E22000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002388.00000000.132732.0122C000.00000002.mdmp\")\n Found reference to API \"TerminateProcess failed for\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp, 00000000-00002388.00000000.132732.05E40000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002388.00000000.132732.05150000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006660.00000000.133205.057C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002388.00000000.132732.0122C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69bc2ff61353f5a277028b99"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"