24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ee,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 8abf8eccfa8a… — Score 74/100 — Hybrid Analysis","description":"Malicious verdict for sample 8abf8eccfa8a…. Malware family: Win/malicious_confidence_60%. Threat score 74/100. 8/27 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2"],"about":{"@type":"SoftwareApplication","name":"8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","applicationCategory":["peexe","executable"],"identifier":"8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","additionalType":"Malicious sample"},"threatScore":74,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T432,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "support.client.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "support.client.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "support.client.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "support.client.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp")26:T726,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found reference to "/cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp")27:T94a,Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "support.client.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "support.client.exe") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; File: "support.client.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "support.client.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "support.client.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "support.client.exe") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "support.client.exe") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; File: "support.client.exe") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "support.client.exe") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp")28:Tfec,Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-120-00425BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-120-00425BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-355-00438863 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-355-00438863 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 20132-366-00439702 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 20132-366-00439702 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 20132-366-00439702 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 20132-366-00439702 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-878-0040CB70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-878-0040CB70 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-940-004361A9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-940-004361A9 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-941-0042776C Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-941-0042776C Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1013-0040EF17 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1013-0040EF17 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1016-00427C0C Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1016-00427C0C Assembly shows XOR instruction xor eax dword ptr [00448000h] in Stream UID: 20132-1022-00427076 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1029-00427ADC Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1029-00427ADC Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1043-00427D2C Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1043-00427D2C Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1046-0042BCAF Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1046-0042BCAF Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1084-0040EEB5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1084-0040EEB5 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1107-004278A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1107-004278A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1142-00436E08 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1142-00436E08 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1143-00436A23 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1143-00436A23 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1144-00436BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1144-00436BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1145-00436B02 Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1145-00436B02 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1146-0043678D Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1146-0043678D Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1873-00424C1B Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1873-00424C1B Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1950-00427CCA Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1950-00427CCA Assembly shows XOR instruction xor edx dword ptr [00448000h] in Stream UID: 20132-1957-004271F6 Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1962-0042784F Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1962-0042784F Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1963-004279AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1963-004279AA Assembly shows XOR instruction xor eax ebp in Stream UID: 20132-1965-00427A7B Assembly shows XOR instruction xor ecx ebp in Stream UID: 20132-1965-00427A7B29:T5e6,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "support.client.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "support.client.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "support.client.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "support.client.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "support.client.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "support.client.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp")2a:Tef2,"support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000009e29f876e8c725030000000028000000240000000000240358f0db000000000000000000000000000000000000000000d0070d0130000000000000000f00000000000d0100000000da0000000000000000000000f0c4250308b224030f000000000000002000000000000d01d0010d01040b0d0100000000000b0d010000000050f0db0050f5f776e8c72503b8f0db0004f1db00 (UID: 00000000-00001800) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001800) "support.client.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001800) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e8efdb008cefdb00226e8b7500002305000000002d6e8b75264990e72d000000ecb7e27310f0db0000000d01b88c2f03f83d26030e0000008000000050efdb0000000d01d4efdb0070c88c7552d7da92feffffff2d000000d0ccf17327000000a4efdb00856a8d751c239275e4efdb00f85f8d7508000000bb698c75b2698c754e4990e72d000000ecb7e27327000000d0ccf173b8efdb002d000000d0ccf17327000000e8efdb00856a8d751c23927530f0db007e8af073ee8cf073738af073773995ee2d000000ecb7e27327000000d0ccf173b413230548132305773995eef8efdb00fc522e74e4f0db00e084f0737f38629afeffffff738af073 (UID: 00000000-00001800) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f2f8767c24b21a030000000cf0db00cd01f976b0ff2f034a00000050f0db002584e973b0ff2f039829230550f0db004484e973f8532e747cf0db0037c1e5735384e97344f0db009932520013cc3f706fb66858ddd9e2db7f381ffb173995ee80f0db00d985e97328cb691a28cb691a010000004e85e9730686d2736bf17cb8f80b9244a510d5f59626b0332f3995ee90f0db001dcef0731e00000000005373feffffffed82f0730000e0730000000000000000b33995eeb0f0db00 (UID: 00000000-00001800) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000d01d0010d01040b0d0100000000000b0d010000000030f0db005916f876240000000000000000000000000024030000000030000000f4a72f03d0a72f033706f776020000000000240324000000000000003cf0db0050f0db00ee13f87601000000ee13f8760000000000000000f082f675343bb21a68f0db0032baf976dca72f0300000000000000000000000090f0db0096513c73dca72f030000000000003a7336e03f73000000000000000001000000a72d30b2f4f0db000dc73f7300003a73facd3f738fc83f7353ddebb200003a7308f1db000100000000005a73feffffff28f1db0000aa3273000000000000000088b72e03d8f0db00 (UID: 00000000-00001800)2b:T610,GetUserDefaultLCID@KERNEL32.dll at 20132-1016-00427C0C EnumSystemLocalesW@KERNEL32.dll at 20132-1022-00427076 GetLocaleInfoW@KERNEL32.dll at 20132-1029-00427ADC GetUserDefaultLCID@KERNEL32.dll at 20132-1046-0042BCAF EnumSystemLocalesW@KERNEL32.dll at 20132-1047-0042B5D1 EnumSystemLocalesW@KERNEL32.dll at 20132-1048-0042B6D5 GetLocaleInfoW@KERNEL32.dll at 20132-1050-0042BADB EnumSystemLocalesW@KERNEL32.dll at 20132-1051-0042B63A EnumSystemLocalesW@KERNEL32.dll at 20132-1957-004271F6 GetLocaleInfoW@KERNEL32.dll at 20132-2048-0042B52A GetUserDefaultLCID@KERNEL32.dll at 20132-2051-0042B61E GetLocaleInfoW@KERNEL32.dll at 20132-2052-0042B764 GetLocaleInfoW@KERNEL32.dll at 20132-2053-0042BBE2 GetLocaleInfoW@KERNEL32.dll at 20132-2054-0042B9B4 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001800-21227-821-01177C0C EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001800-21227-827-01177076 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001800-21227-834-01177ADC GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001800-21227-851-0117BCAF EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001800-21227-852-0117B5D1 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001800-21227-853-0117B6D5 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001800-21227-855-0117BADB EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001800-21227-856-0117B63A EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001800-21227-1762-011771F6 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001800-21227-1853-0117B52A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001800-21227-1856-0117B61E2c:T602,"support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER"; Key: "") "support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES"; Key: "") "support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CRLS"; Key: "") "support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CTLS"; Key: "") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\5BDEFE580A816661CDB57A57107BF4187486EFCC"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\6F474206BCBB391BB82BA9E5DC0302DEF37AEBBE"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3"; Key: "BLOB")2d:T5ab,"support.client.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter dfshim (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfdll.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001800) "support.client.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00001800)2e:T14e1,"support.client.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter ShOpenVerbApplicationW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo_RetAddr (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter ActivateDeploymentW (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00001800) "support.client.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001800)2f:T65ce,Found reference to API (Indicator: "CryptMsgGetParam"; File: "support.client.exe") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "support.client.exe") Found reference to API (Indicator: "CertFindAttribute"; File: "support.client.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "support.client.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "support.client.exe") Found reference to API (Indicator: "CertCloseStore"; File: "support.client.exe") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; File: "support.client.exe") Found reference to API (Indicator: "CertOpenSystemStoreA"; File: "support.client.exe") Found reference to API (Indicator: "CertCreateCertificateContext"; File: "support.client.exe") Found reference to API (Indicator: "FindNextFileW"; File: "support.client.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "support.client.exe") Found reference to API (Indicator: "GetProcAddress"; File: "support.client.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "support.client.exe") Found reference to API (Indicator: "FindNextFileA"; File: "support.client.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "support.client.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "support.client.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "support.client.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "support.client.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "support.client.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "support.client.exe") Found reference to API (Indicator: "CreateThread"; File: "support.client.exe") Found reference to API (Indicator: "SetStdHandle"; File: "support.client.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "support.client.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "support.client.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "support.client.exe") Found reference to API (Indicator: "HeapFree"; File: "support.client.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "support.client.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "support.client.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "support.client.exe") Found reference to API (Indicator: "GetCPInfo"; File: "support.client.exe") Found reference to API (Indicator: "RaiseException"; File: "support.client.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "support.client.exe") Found reference to API (Indicator: "GetACP"; File: "support.client.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "support.client.exe") Found reference to API (Indicator: "TlsFree"; File: "support.client.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "support.client.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "support.client.exe") Found reference to API (Indicator: "CompareStringW"; File: "support.client.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "support.client.exe") Found reference to API (Indicator: "TlsAlloc"; File: "support.client.exe") Found reference to API (Indicator: "SetLastError"; File: "support.client.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "support.client.exe") Found reference to API (Indicator: "GetFileType"; File: "support.client.exe") Found reference to API (Indicator: "ExitProcess"; File: "support.client.exe") Found reference to API (Indicator: "TlsGetValue"; File: "support.client.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "support.client.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "support.client.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "support.client.exe") Found reference to API (Indicator: "WriteFile"; File: "support.client.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "support.client.exe") Found reference to API (Indicator: "CloseHandle"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "support.client.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "support.client.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "support.client.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "support.client.exe") Found reference to API (Indicator: "FreeLibrary"; File: "support.client.exe") Found reference to API (Indicator: "TlsSetValue"; File: "support.client.exe") Found reference to API (Indicator: "FindClose"; File: "support.client.exe") Found reference to API (Indicator: "IsValidLocale"; File: "support.client.exe") Found reference to API (Indicator: "GetOEMCP"; File: "support.client.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "support.client.exe") Found reference to API (Indicator: "EncodePointer"; File: "support.client.exe") Found reference to API (Indicator: "HeapSize"; File: "support.client.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "support.client.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "support.client.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "support.client.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "support.client.exe") Found reference to API (Indicator: "GetLastError"; File: "support.client.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "support.client.exe") Found reference to API (Indicator: "HeapAlloc"; File: "support.client.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "support.client.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "support.client.exe") Found reference to API (Indicator: "LCMapStringW"; File: "support.client.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "support.client.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "support.client.exe") Found reference to API (Indicator: "Sleep"; File: "support.client.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "support.client.exe") Found reference to API (Indicator: "GetStdHandle"; File: "support.client.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "support.client.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "support.client.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "support.client.exe") Found reference to API (Indicator: "RtlUnwind"; File: "support.client.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "support.client.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "support.client.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "support.client.exe") Found reference to API (Indicator: "CreateFileW"; File: "support.client.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "support.client.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "support.client.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "support.client.exe") Found reference to API (Indicator: "DecodePointer"; File: "support.client.exe") Found reference to API (Indicator: "LocalFree"; File: "support.client.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "support.client.exe") Found reference to API (Indicator: "LocalAlloc"; File: "support.client.exe") Found reference to API (Indicator: "TerminateProcess"; File: "support.client.exe") Found reference to API (Indicator: "FlsAlloc"; File: "support.client.exe") Found reference to API (Indicator: "FlsFree"; File: "support.client.exe") Found reference to API (Indicator: "FlsGetValue"; File: "support.client.exe") Found reference to API (Indicator: "FlsSetValue"; File: "support.client.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "support.client.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "support.client.exe") Found reference to API (Indicator: "CompareStringEx"; File: "support.client.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "support.client.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "support.client.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "support.client.exe") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "support.client.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "support.client.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "support.client.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "support.client.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "support.client.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "support.client.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "support.client.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "support.client.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "support.client.exe") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "support.client.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "support.client.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "support.client.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "support.client.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "support.client.exe") Found reference to API (Indicator: "LocateXStateFeature"; File: "support.client.exe") Found reference to API (Indicator: "MessageBoxA"; File: "support.client.exe") Found reference to API (Indicator: "MessageBoxW"; File: "support.client.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "support.client.exe") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetXStateFeaturesMask"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCertificateContext"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CertFindAttribute"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgGetParam"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp")30:T6cb,"support.client.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73740000 "support.client.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73c20000 "support.client.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73c20000 "support.client.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73c20000 "support.client.exe" loaded module "KERNEL32.DLL" at base 76340000 "support.client.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75930000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 73a60000 "support.client.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76340000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 736f0000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76140000 "support.client.exe" loaded module "DFSHIM" at base 735a0000 "support.client.exe" loaded module "ADVAPI32.DLL" at base 739e0000 "support.client.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 730f0000 "support.client.exe" loaded module "SHLWAPI.DLL" at base 75e30000 "support.client.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76310000 "support.client.exe" loaded module "VERSION.DLL" at base 73590000 "support.client.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFDLL.DLL" at base 730c0000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73040000 "support.client.exe" loaded module "USER32.DLL" at base 76b70000 "support.client.exe" loaded module "RPCRT4.DLL" at base 76cf0000 "support.client.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 7631000031:T5ad,"support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")32:Ta72,"support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SUPPORT.CLIENT.EXE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")33:T746,"support.client.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "support.client.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "support.client.exe" trying to access non-existent file "C:\FLTLIB.DLL" "support.client.exe" trying to access non-existent file "C:\MSVCP140.DLL" "support.client.exe" trying to access non-existent file "C:\MSVCP140.dll" "support.client.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "support.client.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "support.client.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "support.client.exe" trying to access non-existent file "C:\BCRYPT.DLL" "support.client.exe" trying to access non-existent file "C:\bcrypt.dll" "support.client.exe" trying to access non-existent file "C:\DFSHIM.DLL" "support.client.exe" trying to access non-existent file "C:\dfshim.DLL" "support.client.exe" trying to access non-existent file "C:\VERSION.DLL" "support.client.exe" trying to access non-existent file "C:\VERSION.dll" "support.client.exe" trying to access non-existent file "C:\MSCOREE.DLL" "support.client.exe" trying to access non-existent file "C:\mscoree.dll" "support.client.exe" trying to access non-existent file "C:\URLMON.DLL" "support.client.exe" trying to access non-existent file "C:\urlmon.dll" "support.client.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "support.client.exe" trying to access non-existent file "C:\iertutil.dll" "support.client.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "support.client.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "support.client.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL"34:Tc14,Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "www.digicert.com110/" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0" Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0p" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl07" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0j" Pattern match: "http://ocsp.digicert.com0h" Pattern match: "http://cacerts.digicert.com/digicertevcodesigningca-sha2.crt0" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0k" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "www.digicert.com1.0" Pattern match: "http://crl3.digicert.com/assured-cs-g1.crl00" Pattern match: "http://crl4.digicert.com/assured-cs-g1.crl0l" Pattern match: "http://ocsp.digicert.com0l" Pattern match: "http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0" Pattern match: "http://ocsp.digicert.com0i" Pattern match: "http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02" Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0" Pattern match: "http://ocsp.digicert.com0o" Pattern match: "cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0" Heuristic match: "pathext=.cn" Pattern match: "cert.com/cps0" Pattern match: "http://ocsp.di%" Pattern match: "crl3.digicert.com/digic" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampi"35:T940,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found URL "http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0n3n5e=.:j" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.di%om0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digic" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0n3n5e=.:j" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampihttp://ocsp.digicert.com0xigicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00001800.00000000.122444.032E7000.00000004.mdmp")36:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001800.00000000.122444.03240000.00000004.mdmp")37:T9fc,"support.client.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001800) "support.client.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001800) "support.client.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001800)38:T4ee,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "support.client.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "support.client.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "support.client.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "support.client.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "support.client.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001800.00000000.122444.0118F000.00000002.mdmp")39:T1eea,"support.client.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "support.client.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\7B0F360B775F76C94A12CA48445AA2D2A875701C"; Key: "BLOB"; Value: "0300000001000000140000007B0F360B775F76C94A12CA48445AA2D2A875701C2000000001000000B4060000308206B030820498A003020102021008AD40B260D29C4C9F5ECDA9BD93AED9300D06092A864886F70D01010C05003062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F74204734301E170D3231303432393030303030305A170D3336303432383233353935395A3069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E6720525341343039362053484133383420323032312043413130820222300D06092A864886F70D01010105000382020F003082020A0282020100D5B42F42D028AD78B75DD539591BB18842F5338CEB3D819770C5BBC48526309FA48E68D85CF5EB342407E14B4FD37843F417D71EDAF9D2D5671A524F0EA157FC8899C191CC81033E4D702464B38DE2087D347D4C8057126B439A99F2C53B1FF2EFCB475A13A64CB3012025F310D38BB2FB08F08AE09D09C065A7FA98804935873D5119E8902178452EA19F2CE118C21ACCC5EE93497042328FFBC6EA1CF3656891A24D4C8211485268DE10BD14575DE8181365C57FB24F852C48A4568435D6F92E9CAA0015D137FE1A0694C27CC8EA1B32E6CAC2F4A7A3030E74A5AF39B6AB6012E3E8D6B9F731E1DCADE418A0D8C1234747B3A10F6EA3AB6D9806831BB76A672DD2BD441A9210818FB03B09D7C79B325AC2FF6A60548B49C193EDE1B45CE06FEB26F98CD5B2F93810E6EACE91F5BED3FB6F9361345CBC93452883362A66285FB073CE8B262506B283D45CF615194CED62E05E33F2E8E8EC0AA7B0032B91B23679BEF7AD081E75A665CCBBE34850F377911AFEDB50A246C8615898F57C02163C8328AD3986ECD4B70D53D0F847E675308DEC30937614A65B4B5D74614D3F129176DEBF58CB72102941F0D5C56D267668114113589ADC262B01F4894D59DB78CF814A3E40475FC98150738510232159608A6454C1CC211AE838197C661CCD78384530994FFF634F4CBBAA0D0853417C583D47B3FAB6EC8C320902CC6C3C0C56110203010001A38201593082015530120603551D130101FF040830060101FF020100301D0603551D0E041604146837E0EBB63BF85F1186FBFE617B088865F44E42301F0603551D23041830168014ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F300E0603551D0F0101FF04040302018630130603551D25040C300A06082B06010505070303307706082B06010505070101046B3069302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D304106082B060105050730028635687474703A2F2F636163657274732E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63727430430603551D1F043C303A3038A036A0348632687474703A2F2F63726C332E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63726C301C0603551D20041530133007060567810C01033008060667810C010401300D06092A864886F70D01010C050003820201003A23443D8D0876EE8FBC3A99D356E0021AA5F84834F32CB6E67466F79472B100CAAF6C302713129E90449F4BFD9EA37C26D537BC3A5D486D95D53F49F427BB16814550FD9CBDB685E0767E3771CB22F75AAA90CFF5936AE3EB20D1D55079889A8A8AC1B6BDA148187EDCD8801A111918CD61998156F6C9E376E7C4E41B5F43F83E94FF76393D9ED499CF4ADD28EB5F26A1955848D51AFED7273FFD90D17686DD1CB0605CF30DA8EEE089A1BD39E1384EDA6EBB369DFBE521535AC3CAE96AF1A23EDB43B833C84F38149299F5DDCE546DD95D02141F40337C03E295B2C221757352CB46D8C4341CA2A54B8DCD6F76372C853F1ACE26E918BE9007B0437F9588208270F0CCCAEFFD29355C1F893855F7378A8B09A1CB0BE9311AFF2E195C3971E1BE9CA70A06D62667B792E64E5FDE7AAC49CF2EA47492ADDB3CA49C861FE3C1561B2B23FF8FB5EA887B706BE6A0BAFD3A3F45A6C4E81691528B41C048844B964DAB4440E38DF01528CEEDF11856072A2F10C40C08643C338FAE288C3CCB8F880B0DBF3BF4CE1E7B8EEFB5EBCBB7F07713E6E7283FAC12AEA52F226C41F9825C1566CC6C0ECAC586C3F626330C074BA0D307026A6A4030484B34A85120BBAD1B8508E2590D6DCA05502BEA4A1C9EA5FDA0A71F0674E7F2D65290FDAF854821F9573BB49C03ED8645F4B4616EBF68E2266086EAC8AFA9FE941DE7631B3A8656784E00") "support.client.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\FF8BFAFA697459874FB9843B1EFDA5C91871A44C"; Key: "BLOB"; Value: "030000000100000014000000FF8BFAFA697459874FB9843B1EFDA5C91871A44C2000000001000000640700003082076030820548A00302010202100FC890218EBC1B3C4B8521F655979371300D06092A864886F70D01010B05003069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E67205253413430393620534841333834203230323120434131301E170D3232303731333030303030305A170D3235303731323233353935395A3065310B30090603550406130255533110300E06035504081307466C6F72696461310E300C0603550407130554616D706131193017060355040A1310436F6E6E656374776973652C204C4C433119301706035504031310436F6E6E656374776973652C204C4C4330820222300D06092A864886F70D01010105000382020F003082020A0282020100DA5D7B6EB44D5D8C63F7C47C18A1BF98759158E061191810BE4001B75443BD96E1DE68459FD72F7FE20ABCDAB9D10541D5B333A191C8694E70EADEB590A46FBACC4BF1E580E3D49900107F31A44BB0761C26E95F32D3D2076FC1CE1550FCC9B80D3A9E126CF948F5D78907F82795BD1C5437F87F582A9CFA3C9ADFB079D3AF1B267A35C2FED12B99AA072DB1A974D8B3704831F91C07C343F8BDFE52A88A5A9BA1CE87A957EED596EA5AF8DC2821F8970898355D467621F188CDA371CBF194625AC45E7682AFC4A7687DFDF58FA12F67DA9F8868F8F1BBAFAA5455922FCE755CCEEEE2C4CAA8C74350420396F445E5B8E2340DDCA227CE4846A787150FF50B982A02FAC5722E2630DA9E7F4F11F61D46C4A3A741834DE00BA96FE8D0EEC53B8D7332FC8567D59DAE58C9DA2B4CD394391F1A35C075CE76E4F58118F42CFFD0F9D097D86E6E40E7174583B89EA38DE2885B9AEED147EFA57DDC17AD421B2C9323575A9E0194576825AED3B586A072B2F4DC6194A5566976865079AC988B1C0CADFD10851BE62B1F79CAD6A937F874EAB8CB3651E29E862D5CAFE9D1B42A83F335D2ABA6EC4EF9D9AA115A069C24916D645DE415844DC365C616628665BA45D57E5A4E9AC0A5B414E8833ED77E4591647937E6F496D5CB708E29E3CA60ED81D594C9954186E08E7DBF3555F0A0A4E56625B4DFDC46577D88321B4719CC21B0A7AD0203010001A382020630820202301F0603551D230418301680146837E0EBB63BF85F1186FBFE617B088865F44E42301D0603551D0E04160414294F9BFF00EDB7D66B2218307D77A83F5C2B0D85300E0603551D0F0101FF04040302078030130603551D25040C300A06082B060105050703033081B50603551D1F0481AD3081AA3053A051A04F864D687474703A2F2F63726C332E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C3053A051A04F864D687474703A2F2F63726C342E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C303E0603551D20043730353033060667810C0104013029302706082B06010505070201161B687474703A2F2F7777772E64696769636572742E636F6D2F43505330819406082B06010505070101048187308184302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D305C06082B060105050730028650687474703A2F2F636163657274732E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E637274300C0603551D130101FF04023000300D06092A864886F70D01010B050003820201004E334E35453D2EC365082BD7E988392596A078B66CC91A7D52995886D9D2EF5EB1160E611AB54B00704E0CD7FDF1271871D56584CE06413B96E26D0396EB657CBBD5C12039D0130D52E31D1A7A186CA20878378C832655DB9AF8FC8E0672CA942D35FD13EE8803A7A747A502FF39CE8BBB6B054D78BE49EDB5A70F7C5C9A0EDF3A6A7E3DE78AC01B08A05198C6A4CCD6443CED8F4D9A65A23E67B09A93AFE01C2E3F3D90581CF5138F931A3AF8A15F27CE1A515A1A47F177392D6D3729BC62CE606793D202B89FF88531F035675680E405B49414971BF9F36528C1C44ED17CED9DEE353C14465719A0391E3197D851DF01AE8E36CB7918A26CA2EEC0DA555C4FA072F05A7EE59382E093A4EDD2698645C04A17A3903CA9FDAB62E033FEC0F8653DD193B9050A78B0E1101B73CE2CAF73A677373783D2A1EE3CE794055E0535AC1EDC9EB133E043D16CB6F811F2D7CC855F098673920D0948C2F93A705EEA762CA78AFD8D4B47A5F4F5EC02B34D77DEFBBE7E854B50B26182DC05BA265FE3BDE3FBD6A12F2AA9656D39361D93425789714323D74FFEF6347A5AE3E44A6322D76E604BF759BEE5F7A8023D55A2356FD9ED1041D584FED8C27697369A1BE159C96722B21A92A6C4D9D17DAC189B047538F099B1A3D1EF72882F0E09A767D622F371976CD4B95E6357C2C7B97499B81F04607C9FE72A0BD13F1C899107531D4785B700")3a:T9fa,Found string "FlsAlloc" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "CorExitProcess" (Source: support.client.exe, API is part of module: MSCOREEI.DLL) Found string "AreFileApisANSI" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "EnumSystemLocalesEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetActiveWindow" (Source: support.client.exe, API is part of module: USER32.DLL) Found string "GetCurrentPackageId" (Source: support.client.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetDateFormatEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetEnabledXStateFeatures" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetFileInformationByHandleEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetLastActivePopup" (Source: support.client.exe, API is part of module: USER32.DLL) Found string "GetLocaleInfoEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: support.client.exe, API is part of module: USER32.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultLocaleName" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserObjectInformationW" (Source: support.client.exe, API is part of module: USER32.DLL) Found string "GetXStateFeaturesMask" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "LCIDToLocaleName" (Source: support.client.exe, API is part of module: KERNELBASE.DLL)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":74,"unified_at_epoch_ms":1791263574550,"unified_at":"2026-10-06T05:12:54.550Z","metadata":{"hashes":{"sha256":"8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","sha1":"e8dd5f0906fca19559908d27f0ed3c55fdfdfbed","md5":"b11a75c9d60e50866ba0d84af1a155c6","sha512":"b64d93af7a76b3aad82c3b01dc7ba61ee3e2e9e54537b9a4b796270f37d1624912c358a0c51849b6bb10b0e7569044972cdd88690737b5d76f8104e3ad8511dd","ssdeep":"6144:dmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti99d:Y1iw7gryNkSV1hy1Z1u2JLI9z","ssdeep_chunks":["6144:dmlfAgi","6144:mlfAgiw","6144:lfAgiw7","6144:fAgiw7O","6144:Agiw7Op","6144:giw7Op5","6144:iw7Op5r","6144:w7Op5ry","6144:7Op5ryN","6144:Op5ryNk","6144:p5ryNkS","6144:5ryNkS7","6144:ryNkS7Z","6144:yNkS7Z1","6144:NkS7Z12","6144:kS7Z12w","6144:S7Z12wv","6144:7Z12wvt","6144:Z12wvtG","6144:12wvtGV","6144:2wvtGVG","6144:wvtGVG3","6144:vtGVG3i","6144:tGVG3iV","6144:GVG3iVt","6144:VG3iVt8","6144:G3iVt8e","6144:3iVt8eZ","6144:iVt8eZ1","6144:Vt8eZ1u","6144:t8eZ1u2","6144:8eZ1u2J","6144:eZ1u2J/","6144:Z1u2J/x","6144:1u2J/xF","6144:u2J/xFt","6144:2J/xFti","6144:J/xFti9","6144:/xFti99","6144:xFti99d","12288:dmlfAgi","12288:mlfAgiw","12288:lfAgiw7","12288:fAgiw7O","12288:Agiw7Op","12288:giw7Op5","12288:iw7Op5r","12288:w7Op5ry","12288:7Op5ryN","12288:Op5ryNk","12288:p5ryNkS","12288:5ryNkS7","12288:ryNkS7Z","12288:yNkS7Z1","12288:NkS7Z12","12288:kS7Z12w","12288:S7Z12wv","12288:7Z12wvt","12288:Z12wvtG","12288:12wvtGV","12288:2wvtGVG","12288:wvtGVG3","12288:vtGVG3i","12288:tGVG3iV","12288:GVG3iVt","12288:VG3iVt8","12288:G3iVt8e","12288:3iVt8eZ","12288:iVt8eZ1","12288:Vt8eZ1u","12288:t8eZ1u2","12288:8eZ1u2J","12288:eZ1u2J/","12288:Z1u2J/x","12288:1u2J/xF","12288:u2J/xFt","12288:2J/xFti","12288:J/xFti9","12288:/xFti99","12288:xFti99d","6144:Y1iw7gr","6144:1iw7gry","6144:iw7gryN","6144:w7gryNk","6144:7gryNkS","6144:gryNkSV","6144:ryNkSV1","6144:yNkSV1h","6144:NkSV1hy","6144:kSV1hy1","6144:SV1hy1Z","6144:V1hy1Z1","6144:1hy1Z1u","6144:hy1Z1u2","6144:y1Z1u2J","6144:1Z1u2JL","6144:Z1u2JLI","6144:1u2JLI9","6144:u2JLI9z"],"imphash":"c2fe6927e1db8cf00400dbef9e5d35be","pehash":"38d5642073565301f28a43c0e5980ba775f5e400"},"file_info":{"file_name":"8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","file_type":["peexe","executable"],"file_type_id":"exe","file_size":312536,"entropy":6.64,"compile_timestamp":"2025-06-06T01:36:57","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791262514000,"last_seen":1791263488000,"last_multi_scan":1791263488000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":250390,"raw_size":250880},{"name":".rdata","virtual_address":"0x3f000","virtual_size":36784,"raw_size":36864},{"name":".data","virtual_address":"0x48000","virtual_size":7048,"raw_size":2560},{"name":".rsrc","virtual_address":"0x4a000","virtual_size":480,"raw_size":512},{"name":".reloc","virtual_address":"0x4b000","virtual_size":8884,"raw_size":9216}],"section_names":[".text",".rdata",".data",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":74,"tags":["malgent","nemucod","ransomware","phorpiex"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":109,"suspicious_count":14,"malicious_count":0,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare[RemoteAdmin]/Win32.ConnectWise","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"APPL/AgentW32.ToolX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HackTool/ConnectWiseControl.j","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"RemoteTool ( 005ce31e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.DLA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.ConnectWise.Win32.134","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"RiskWare[RemoteAdmin]/ConnectWise","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Able to discover operating system information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"support.client.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001800.00000000.122444.03240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"support.client.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"support.client.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-882500058 [PID: 1800]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-882509523 [PID: 1800]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-882702386 [PID: 1800]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-882715554 [PID: 1800]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-882869147 [PID: 1800]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-882878006 [PID: 1800]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-883221224 [PID: 1800]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00001800-00000C15-883230661 [PID: 1800]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"support.client.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"support.client.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"support.client.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"support.client.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"support.client.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 20132-3082-00401E8A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001800-21227-9-0115153C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001800-21227-81-011741D5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001800-21227-434-01151CFA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001800-21227-3267-01151E8A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$27","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"support.client.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"support.client.exe\")\n Found reference to API \"CertDeleteCertificateFromStore\" (Indicator: \"CertDeleteCertificateFromStore\"; File: \"support.client.exe\")\n Found reference to API \"CertOpenSystemStoreA\" (Indicator: \"CertOpenSystemStore\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001800.00000000.122444.03240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 299963; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 4114; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 40322; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 299944; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 300518; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 300634; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 303846; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 306636; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 306883; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"support.client.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"support.client.exe\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"support.client.exe\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"support.client.exe\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"support.client.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"support.client.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001800.00000000.122444.03240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"support.client.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001800)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"support.client.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001800)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"support.client.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001800)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.dll at 20132-1876-004254C4\n FindFirstFileExW@KERNEL32.dll at 20132-1877-004254EF\n FindNextFileA@KERNEL32.dll at 20132-1878-0042551A\n FindNextFileW@KERNEL32.dll at 20132-1879-00425531\n FindFirstFileExA@KERNEL32.DLL at 00000000-00001800-21227-671-01175188\n FindFirstFileExW@KERNEL32.DLL at 00000000-00001800-21227-698-0117530C\n FindFirstFileExA@KERNEL32.DLL at 00000000-00001800-21227-1681-011754C4\n FindFirstFileExW@KERNEL32.DLL at 00000000-00001800-21227-1682-011754EF\n FindNextFileA@KERNEL32.DLL at 00000000-00001800-21227-1683-0117551A\n FindNextFileW@KERNEL32.DLL at 00000000-00001800-21227-1684-01175531","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 20132-1966-00427B48\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001800-21227-454-01151BC9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001800-21227-1771-01177B48\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001800-21227-2716-0118A6BA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 20132-1966-00427B48\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001800-21227-454-01151BC9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001800-21227-1771-01177B48\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001800-21227-2716-0118A6BA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"support.client.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"support.client.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"support.client.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"support.client.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 54843)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"support.client.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"support.client.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe\" - (UID: 00000000-00001800)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\builds\\cc\\cwcontrol\\Product\\ClickOnceRunner\\Release\\ClickOnceRunner.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"54548,1428,3143,,CreateProcessW,kernel32.dll,\"00:31:49.718\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"support.client.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.dll at 20132-880-00424A84\n WaitForSingleObjectEx@KERNEL32.dll at 20132-1851-00424734\n Sleep@KERNEL32.DLL at 00000000-00001800-21227-410-01151000\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00001800-21227-645-01174A84\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00001800-21227-1656-01174734","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: support.client.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.dll at 20132-1960-004276E9\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001800-21227-49-01177638\n LoadLibraryA@KERNEL32.DLL at 00000000-00001800-21227-410-01151000\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001800-21227-563-0115A676\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001800-21227-1765-011776E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"support.client.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"support.client.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"support.client.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00001800.00000000.122444.032E7000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process support.client.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:1800:168:WilStaging_02\"\n Process support.client.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1800:168:WilStaging_02\"\n Process support.client.exe created mutex with name \"Local\\SM0:1800:168:WilStaging_02\"\n Process support.client.exe created mutex with name \"SM0:1800:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"support.client.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"noreply@vmware.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00001800.00000000.122444.032E7000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"support.client.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76140000\n \"support.client.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"support.client.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76CF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"support.client.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"support.client.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"support.client.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"support.client.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"support.client.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"support.client.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"support.client.exe\" file has an entrypoint instructions - \"call\t0x401c16,jmp\t0x40135f,push\tebp,mov\tebp, esp,push\t0,call\tdword ptr [0x43f048],push\tdword ptr [ebp + 8],call\tdword ptr [0x43f044],push\t0xc0000409,call\tdword ptr [0x43f04c],push\teax,call\tdword ptr [0x43f050],pop\tebp,ret\t,push\tebp,mov\tebp, esp,sub\tesp, 0x324,push\t0x17,call\tdword ptr [0x43f054],test\teax, eax,je\t0x40157e,push\t2,pop\tecx,int\t0x29,mov\tdword ptr [0x448a20], eax,mov\tdword ptr [0x448a1c], ecx,mov\tdword ptr [0x448a18], edx,mov\tdword ptr [0x448a14], ebx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe\" [Source: 00000000-00001800-00000C47-2893554548]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00001800-00000C2B-883441467]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\dfdll.dll\" [Source: 00000000-00001800-00000C2B-883577284]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: FF:8B:FA:FA:69:74:59:87:4F:B9:84:3B:1E:FD:A5:C9:18:71:A4:4C; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"support.client.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"support.client.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"support.client.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\dfsvc.exe.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"support.client.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"support.client.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"support.client.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"support.client.exe\" trying to touch file \"C:\\support.client.exe\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"support.client.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"\n \"support.client.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\mscoree.dll.local\"\n \"support.client.exe\" trying to access non-existent file \"C:\\.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.15\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.17\"\n \"2.5.29.19\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \",,RtlGetNtProductType,NTDLL.dll,\"00:31:49.67\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: support.client.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"support.client.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"support.client.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"support.client.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"support.client.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00001800.00000000.122444.03240000.00000004.mdmp, 00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"support.client.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"support.client.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"support.client.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"support.client.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"support.client.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"support.client.exe\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001800.00000000.122444.032E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"support.client.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"support.client.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"support.client.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"support.client.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001800.00000000.122444.0118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"support.client.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"support.client.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"support.client.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"support.client.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.dll at 20132-880-00424A84\n IsDebuggerPresent@KERNEL32.dll at 20132-1851-00424734\n OutputDebugStringA@KERNEL32.dll at 20132-1861-004249EA\n OutputDebugStringW@KERNEL32.dll at 20132-1862-004249FC\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00001800-21227-81-011741D5\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00001800-21227-434-01151CFA\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00001800-21227-645-01174A84\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00001800-21227-1656-01174734\n OutputDebugStringA@KERNEL32.DLL at 00000000-00001800-21227-1666-011749EA\n OutputDebugStringW@KERNEL32.DLL at 00000000-00001800-21227-1667-011749FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"support.client.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00001800-21227-432-011521DA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 20132-1873-00424C1B\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00001800-21227-103-0115E2D6\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001800-21227-112-0115E277\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001800-21227-1678-01174C1B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001800-21227-2192-01151E48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 20132-1986-004288F7\n GetStartupInfoW@KERNEL32.DLL at 00000000-00001800-21227-455-01151E0F\n GetStartupInfoW@KERNEL32.DLL at 00000000-00001800-21227-1791-011788F7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\support.client.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/26 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature match for RMM tool activity (screenconnect) detected in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_RMM_ConnectWise_ScreenConnect_CERT\" matched file \"sample.bin\" as \"Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 20132-3389-00426512\n GetCommandLineA@KERNEL32.DLL at 00000000-00001800-21227-3082-01176512","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 20132-879-0040CBED\n GetModuleFileNameW@KERNEL32.dll at 20132-903-0040CFA3\n GetModuleFileNameA@KERNEL32.dll at 20132-906-0040D0C2\n GetModuleFileNameW@KERNEL32.dll at 20132-907-0040D0DC\n GetModuleFileNameW@KERNEL32.dll at 20132-3083-00401228\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00001800-21227-410-01151000\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00001800-21227-644-0115CBED\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00001800-21227-669-0115CE7F\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00001800-21227-696-0115CFA3\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00001800-21227-705-0115D0C2\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00001800-21227-706-0115D0DC\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00001800-21227-2809-01151228","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"support.client.exe\" claimed CRC 333308 while the actual is CRC 359132","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CertDeleteCertificateFromStore\n FindNextFileW\n GetProcAddress\n FindNextFileA\n FindFirstFileExA\n LoadLibraryExW\n IsDebuggerPresent\n CreateThread\n FindFirstFileExW\n LoadLibraryA\n GetStartupInfoW\n GetCommandLineW\n WriteFile\n GetModuleFileNameW\n OutputDebugStringA\n OutputDebugStringW\n UnhandledExceptionFilter\n Sleep\n GetModuleFileNameA\n GetModuleHandleW\n GetModuleHandleExW\n CreateFileW\n GetCommandLineA\n TerminateProcess","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies system certificates settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]}],"intel_graph":{"map":{"File:287bac010247fd62ad8e85a48b6ba98988cd5a497756557051009603e053b815":{"type":"File","value":"287bac010247fd62ad8e85a48b6ba98988cd5a497756557051009603e053b815","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2":{"type":"File","value":"8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"}},"chains":[{"id":"1556892602191108876","root":"File:8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","to_key":"File:287bac010247fd62ad8e85a48b6ba98988cd5a497756557051009603e053b815"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","edges":[{"edge_kind":"extracted","from_key":"File:8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","to_key":"File:287bac010247fd62ad8e85a48b6ba98988cd5a497756557051009603e053b815"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["malgent","nemucod","ransomware","phorpiex"],"sandbox_reports":[{"id":"6ac482fd69314767200b93fc","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":74,"malware_family":"RemoteTool","submit_name":"support.client.exe","analysis_start_time":"2026-10-06T05:11:28+00:00","indicators_count":{"informative":109,"suspicious":20,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}],"processes":[{"pid":1800,"ppid":0,"name":"support.client.exe","command_line":"","sha256":"8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2","normalized_path":"C:\\support.client.exe","uid":"00000000-00001800","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["oleaut32.dll","wintrust.dll","gdi32.dll","imm32.dll","shlwapi.dll","powrprof.dll","urlmon.dll","mscoreei.dll","uxtheme.dll","clbcatq.dll","advapi32.dll","SHCore.dll","ntdll.dll","kernel32.dll","KernelBase.dll","VxSSL32.dll","bcryptprimitives.dll","gdi32full.dll","combase.dll","windows.storage.dll","msvcp_win.dll","wow64win.dll","sechost.dll","shell32.dll","wow64cpu.dll","apphelp.dll","rpcrt4.dll","fltLib.dll","cryptbase.dll","msvcp140.dll","rsaenh.dll","wow64.dll","win32u.dll","vcruntime140.dll","ole32.dll","imagehlp.dll","bcrypt.dll","dfshim.dll","cfgmgr32.dll","msvcrt.dll","cryptsp.dll","version.dll","kernel.appcore.dll","profapi.dll","mscoree.dll","iertutil.dll","dfdll.dll","user32.dll","crypt32.dll","ucrtbase.dll","msasn1.dll","ws2_32.dll","sspicli.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"287bac010247fd62ad8e85a48b6ba98988cd5a497756557051009603e053b815","sha256":"287bac010247fd62ad8e85a48b6ba98988cd5a497756557051009603e053b815","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\7B0F360B775F76C94A12CA48445AA2D2A875701C\\","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\\","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\7B0F360B775F76C94A12CA48445AA2D2A875701C\\7B0F360B775F76C94A12CA48445AA2D2A875701C","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\FF8BFAFA697459874FB9843B1EFDA5C91871A44C\\FF8BFAFA697459874FB9843B1EFDA5C91871A44C","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"name":"Local\\SM0:1800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]},{"name":"SM0:1800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac482fd69314767200b93fc"}]}]}},"report_ids":{"sandbox_job_ids":["6ac482fd69314767200b93fc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 8abf8eccfa8a… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8abf8eccfa8a…. Malware family: Win/malicious_confidence_60%. Threat score 74/100. 8/27 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 8abf8eccfa8a… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8abf8eccfa8a…. Malware family: Win/malicious_confidence_60%. Threat score 74/100. 8/27 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8abf8eccfa8a562200bf833e1900995a22b259b854fa1db2908d957f66243ac2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 8abf8eccfa8a… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8abf8eccfa8a…. Malware family: Win/malicious_confidence_60%. Threat score 74/100. 8/27 AV engines flagged this file. 0 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]