26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/Agent.JJT trojan Sample 8b5c263809c6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8b5c263809c6…. Malware family: Win64/Agent.JJT trojan. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","keywords":["Malicious","Win64/Agent.JJT trojan","malware analysis","sandbox report","threat intelligence","8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"],"about":{"@type":"SoftwareApplication","name":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","applicationCategory":["peexe","64bits","executable"],"identifier":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/Agent.JJT trojan","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T80a,Found reference to API "socket connect " (Indicator: " connect "; Source: "sample.bin"), Found reference to API "None of the discovered or specified addresses match the socket address family." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Once the socket has been disconnected, you can only reconnect again asynchronously, and only to a different EndPoint. BeginConnect must be called on a thread that won't exit until the operation has been completed." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Cannot block a call on this socket while an earlier asynchronous call is in progress." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "{0}: The socket must not be bound or connected." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "An asynchronous socket operation is already in progress using this SocketAsyncEventArgs instance." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "You must call the Bind method before performing this operation." (Indicator: " bind "; Source: "sample.bin"), Found reference to API "Once the socket has been disconnected, you can only accept again asynchronously. BeginAccept must be called on a thread that won't exit until the operation has been completed." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Unable to connect to the remote server" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "SOCKS server failed to connect to the destination. Received error code 0x{0}." (Indicator: " connect "; Source: "sample.bin")28:T6db,Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlywindowsdevicegroup", Heuristic match: "system.readonlyssystem.sz", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarysid", Pattern match: "http://www.w3.org/2001/xmlschema#string", Pattern match: "https://socks4:/", Pattern match: "http://www.w3.org/2001/xmlschema#boolean", Pattern match: "http://www.w3.org/2001/xmlschema#integer64", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsdeviceclaim", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/denyonlyprimarygroupsid", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsuserclaim", Pattern match: "https://aka.ms/nativeaot-compatibility", Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", Pattern match: "https://aka.ms/globalizationinvariantmode", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid", Pattern match: "https://aka.ms/dotnet-warnings/{0", Heuristic match: "dns.question.name", Heuristic match: "system.ma", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid", Heuristic match: "tls.protocol.name", Pattern match: "http://www.w3.org/2001/xmlschema#uinteger64", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowssubauthority", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role", Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid", Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsdevicegroup"29:T4de,Found reference to "SHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "CMSRC2wrap" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "Keys used with the ECDsaCng algorithm must have an algorithm group of ECDsa." (Indicator: "ECDsa"; Source: "sample.bin"), Found reference to "Keys used with the ECDsaCng algorithm must have an algorithm group of ECDsa." (Indicator: "ECDsaCng"; Source: "sample.bin"), Found reference to "The specified named curve parameters are not valid. Only the Oid parameter must be set." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "SHA384" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "Keys used with the ECDiffieHellmanCng algorithm must have an algorithm group of ECDiffieHellman." (Indicator: "ECDiffieHellman"; Source: "sample.bin"), Found reference to "Keys used with the ECDiffieHellmanCng algorithm must have an algorithm group of ECDiffieHellman." (Indicator: "ECDiffieHellmanCng"; Source: "sample.bin"), Found reference to "The specified Oid ({0}) is not valid. The Oid.FriendlyName or Oid.Value property must be set." (Indicator: "Oid"; Source: "sample.bin"), Found reference to "ECDH_STD_SHA384_KDF" (Indicator: "SHA384"; Source: "sample.bin")2a:T96e,Found string "Microsoft Base DSS and Diffie-Hellman Cryptographic Provider" (Indicator: "diffie-hellman"; Source: "sample.bin"), Found string "sha384ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "sha1ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "aes256" (Indicator: "aes"; Source: "sample.bin"), Found string "aes256" (Indicator: "aes256"; Source: "sample.bin"), Found string "ECDSA_P521" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ecdsa_p384" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "nistp256ecdsa_p2dsa_p256nistp384ecdsa_p3dsa_p384nistp521ecdsa_p5dsa_p521" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "aes256wrap" (Indicator: "aes"; Source: "sample.bin"), Found string "aes256wrap" (Indicator: "aes256"; Source: "sample.bin"), Found string "Keys used with the ECDsaCng algorithm must have an algorithm group of ECDsa." (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ecdsa_p521" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "sha256ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "3des" (Indicator: "3des"; Source: "sample.bin"), Found string "Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider" (Indicator: "diffie-hellman"; Source: "sample.bin"), Found string "aes128" (Indicator: "aes"; Source: "sample.bin"), Found string "aes128" (Indicator: "aes128"; Source: "sample.bin"), Found string "aes192" (Indicator: "aes"; Source: "sample.bin"), Found string "aes192" (Indicator: "aes192"; Source: "sample.bin"), Found string "ecdsa_p256" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "RSAES_OAEP" (Indicator: "aes"; Source: "sample.bin"), Found string "ecdsa_p5dsa_p521ecdsa_p3dsa_p384ecdsa_p2dsa_p256" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "CMS3DESwrap" (Indicator: "3des"; Source: "sample.bin"), Found string "ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "aes192wrap" (Indicator: "aes"; Source: "sample.bin"), Found string "aes192wrap" (Indicator: "aes192"; Source: "sample.bin"), Found string "aes128wrap" (Indicator: "aes"; Source: "sample.bin"), Found string "aes128wrap" (Indicator: "aes128"; Source: "sample.bin"), Found string "sha512ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "sample.bin")2b:T47d,Found string "GZipStream" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found string "(DecompressionHandler" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found string ""DecompressionFail" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), Found string "g__ThrowCannotReadFromDeflateStreamException|47_0" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), Found string "@CreateContentReadStreamAsyncCore2CreateDecompressionStream" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), Found string "BEnsureDecompressionHandlerFactory6ValidateAndNormalizeRequest" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), Found string "Zg__CreateHandlerAndSendAsync|115_0Vb__113_0@" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), Found string "unknown compression method" (Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), file/memory contains long string(Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")2c:T10b6,Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThread@" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "Z#2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject&AssignWorkItemQueue@" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "*UnassignWorkItemQueue$CreateThreadLocals@" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "VGetOrCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "AddRefLCreateThreadLocalCompletionCountObject DispatchCallback" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "4g____PInvoke|8_0>g____PInvoke|9_0@g____PInvoke|11_0" (Indicator: "FreeMemory"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThread@" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "Z#2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject&AssignWorkItemQueue@" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "*UnassignWorkItemQueue$CreateThreadLocals@" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "VGetOrCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "AddRefLCreateThreadLocalCompletionCountObject DispatchCallback" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "4g____PInvoke|8_0>g____PInvoke|9_0@g____PInvoke|11_0" (Indicator: "FreeMemory"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")2d:T694,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")2e:T717,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"), Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"), Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")2f:T73e,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")30:T1294,Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CryptFindOIDInfo" (Indicator: "CryptFindOIDInfo"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertAddCertificateLinkToStore" (Indicator: "CertAddCertificateLinkToStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CryptFormatObject" (Indicator: "CryptFormatObject"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertControlStore" (Indicator: "CertControlStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CryptImportPublicKeyInfoEx2" (Indicator: "CryptImportPublicKeyInfo"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CryptImportPublicKeyInfoEx2" (Indicator: "CryptImportPublicKeyInfoEx"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "CryptImportPublicKeyInfoEx2" (Indicator: "CryptImportPublicKeyInfoEx2"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "BCryptExportKey" (Indicator: "BCryptExportKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "BCryptExportKey" (Indicator: "CryptExportKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a")31:T815,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "&BCryptImportKeyPair" (Indicator: "BCryptImportKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "@BCryptOpenAlgorithmProviderFlags" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "&BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")32:Td28,Assembly shows XOR instruction xor rax rsp in Stream UID: 763-16714-0000000140225B20 Assembly shows XOR instruction xor eax esp in Stream UID: 763-16714-0000000140225B20 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-16714-0000000140225B20 Assembly shows XOR instruction xor ecx esp in Stream UID: 763-16714-0000000140225B20 Assembly shows XOR instruction xor rax rsp in Stream UID: 763-16830-00000001402363C0 Assembly shows XOR instruction xor eax esp in Stream UID: 763-16830-00000001402363C0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-16830-00000001402363C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 763-16830-00000001402363C0 Assembly shows XOR instruction xor rax rsp in Stream UID: 763-16832-0000000140235DA0 Assembly shows XOR instruction xor eax esp in Stream UID: 763-16832-0000000140235DA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-16832-0000000140235DA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 763-16832-0000000140235DA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 763-16833-0000000140235BC0 Assembly shows XOR instruction xor eax esp in Stream UID: 763-16833-0000000140235BC0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-16833-0000000140235BC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 763-16833-0000000140235BC0 Assembly shows XOR instruction xor rax rsp in Stream UID: 763-16834-00000001402359D0 Assembly shows XOR instruction xor eax esp in Stream UID: 763-16834-00000001402359D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-16834-00000001402359D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 763-16834-00000001402359D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 763-16887-000000014022DB60 Assembly shows XOR instruction xor eax esp in Stream UID: 763-16887-000000014022DB60 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-16887-000000014022DB60 Assembly shows XOR instruction xor ecx esp in Stream UID: 763-16887-000000014022DB60 Assembly shows XOR instruction xor rax rsp in Stream UID: 763-16889-000000014022D940 Assembly shows XOR instruction xor eax esp in Stream UID: 763-16889-000000014022D940 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-16889-000000014022D940 Assembly shows XOR instruction xor ecx esp in Stream UID: 763-16889-000000014022D940 Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-26478-000000014022ED0B Assembly shows XOR instruction xor ecx esp in Stream UID: 763-26478-000000014022ED0B Assembly shows XOR instruction xor rcx rsp in Stream UID: 763-28016-00000001402BE83E Assembly shows XOR instruction xor ecx esp in Stream UID: 763-28016-00000001402BE83E Assembly shows XOR instruction xor qword ptr [rsp+20h] rax in Stream UID: 763-38070-00000001402BDB1A Assembly shows XOR instruction xor dword ptr [rsp+20h] eax in Stream UID: 763-38070-00000001402BDB1A Assembly shows XOR instruction xor rcx rax in Stream UID: 763-38070-00000001402BDB1A Assembly shows XOR instruction xor ecx eax in Stream UID: 763-38070-00000001402BDB1A Assembly shows XOR instruction xor rcx qword ptr [rsp+20h] in Stream UID: 763-38070-00000001402BDB1A Assembly shows XOR instruction xor ecx dword ptr [rsp+20h] in Stream UID: 763-38070-00000001402BDB1A33:Tf9f,Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CryptDecodeObject" (Indicator: "CryptDecodeObject"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CryptImportPublicKeyInfoEx2" (Indicator: "CryptImportPublicKeyInfo"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptExportKey" (Indicator: "CryptExportKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptCreateHash" (Indicator: "CryptCreateHash"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptHashData" (Indicator: "CryptHashData"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptImportKeyPair" (Indicator: "CryptImportKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "NCryptGetProperty" (Indicator: "NCryptGetProperty"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "NCryptImportKey" (Indicator: "CryptImportKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "NCryptFreeObject" (Indicator: "NCryptFreeObject"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "NCryptSetProperty" (Indicator: "NCryptSetProperty"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "4CertFreeCertificateContext@CertVerifyCertificateChainPolicy" (Indicator: "CertFreeCertificateContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "&CryptAcquireContext" (Indicator: "CryptAcquireContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CryptGenKey" (Indicator: "CryptGenKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ".CryptGetDefaultProvider" (Indicator: "CryptGetDefaultProvider"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CryptGetKeyParam" (Indicator: "CryptGetKeyParam"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ""CryptSetProvParam" (Indicator: "CryptSetProvParam"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"), Found reference to API ""CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a")34:T617,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI35:T32c4,Found XOR loop in file "sample.bin" at offset 1283612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3327568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3816568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3983831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4030952; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4564192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4678363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4695780; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4775998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4776102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4778898; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4853221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5263000; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5285788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5295592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5413216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 78921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 436670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 638409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 705213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 715911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 715924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 723285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 776137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 776772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 781355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 782409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 822934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 824425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 824762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 826073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 826207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 826277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 851226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 859177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 881290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 885281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 973695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1202596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1202651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1202954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1209043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1209281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1237232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1237957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1277890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1288195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1289179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1307005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1309962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1402043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1419749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1433905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1434017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1434083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1434141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1434305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1646246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1717458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1717538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1722260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1763822; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1826216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1826240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1826316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1826340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1854250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1935177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1969905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1970422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1973770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1982457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2124702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2124817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2125063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2125262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2125489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2125756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2126082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2126307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2139919; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2147532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2156493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2171424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2221127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2221471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2298023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2837552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2837559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2906262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2990015; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048427; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048456; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048619; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048833; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3048957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3105016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3105057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3105371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3111569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3112605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3112640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3112726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256700; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3256780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3334793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3426322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3435050; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4009331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4656741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4864717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 274856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 503214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1991682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1995229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2028962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2032509; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2129597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2340767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2340854; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2340919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2372287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2420127; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2420210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2420271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3314016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3314240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3420208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3975823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4050472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4280779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4281395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4545420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4582705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4634542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4640478; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4677123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4692623; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4699446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4715794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4721287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4731786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4745389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4784415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4813527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4892708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4922006; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4957224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4957240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4969972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5283028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5336392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5432320; code bytes = 803036:T52f,Found system information discovery API: "GetSystemInfo" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found system information discovery API: "ExpandEnvironmentStringsW" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found system information discovery API: "#*RtlNtStatusToDosError" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found system information discovery API: "0NtQuerySystemInformation" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found system information discovery API: "#*RtlNtStatusToDosError" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found system information discovery API: "0NtQuerySystemInformation" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"37:T80e,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002136)38:T52a,Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")39:T8be,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")3a:T530,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter C:\winhttp.dll (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter C:\sspicli.dll (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter sspicli.dll (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00002136)3b:Tdbf,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00002136) "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00002136)3c:Tf91,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThread@" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "Z#2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject&AssignWorkItemQueue@" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "*UnassignWorkItemQueue$CreateThreadLocals@" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "VGetOrCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "AddRefLCreateThreadLocalCompletionCountObject DispatchCallback" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "CreateThread@" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "Z#2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject&AssignWorkItemQueue@" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "*UnassignWorkItemQueue$CreateThreadLocals@" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "VGetOrCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "AddRefLCreateThreadLocalCompletionCountObject DispatchCallback" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")3d:Tdf0,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderAttachDictionary" at ordinal 1 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderCreateInstance" at ordinal 2 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderDecompress" at ordinal 3 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderDecompressStream" at ordinal 4 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderDestroyInstance" at ordinal 5 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderErrorString" at ordinal 6 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderGetErrorCode" at ordinal 7 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderHasMoreOutput" at ordinal 8 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderIsFinished" at ordinal 9 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderIsUsed" at ordinal 10 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderSetMetadataCallbacks" at ordinal 11 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderSetParameter" at ordinal 12 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderTakeOutput" at ordinal 13 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDecoderVersion" at ordinal 14 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDefaultAllocFunc" at ordinal 15 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliDefaultFreeFunc" at ordinal 16 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderAttachPreparedDictionary" at ordinal 17 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderCompress" at ordinal 18 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderCompressStream" at ordinal 19 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderCreateInstance" at ordinal 20 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderDestroyInstance" at ordinal 21 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderDestroyPreparedDictionary" at ordinal 22 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderHasMoreOutput" at ordinal 23 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderIsFinished" at ordinal 24 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" contains export function called "BrotliEncoderMaxCompressedSize" at ordinal 253e:T8e7,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffc78b0000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "KERNEL32" at base 7ffffe020000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffffc560000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "WINHTTP.DLL" at base 7ffff5250000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "RPCRT4.DLL" at base 7ffffe210000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "KERNEL32.DLL" at base 7ffffe020000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fffde0d0000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "NTDLL.DLL" at base 7ffffed90000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffffb670000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\WSHUNIX.DLL" at base 7fffeb900000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffff3760000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffff49b0000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "SSPICLI.DLL" at base 7ffffb450000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffffb070000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffff9710000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffffb170000 "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffffb2000003f:T607,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"), Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"), Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")40:Ta2b,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")41:Tf75,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "")42:T6f2,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "\Device\ConDrv\Server" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "\Device\ConDrv\\Reference" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "\Device\ConDrv\\Connect" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "\Device\ConDrv\\Input" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "\Device\ConDrv\\Output" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to touch file "C:\bcrypt.dll"43:T74c,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\bcrypt.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\ncrypt.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\NTASN1.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\MSVCP140.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\winhttp.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\ntdll.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\sspicli.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\kernel32.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\MSASN1.dll" "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" trying to access non-existent file "C:\CRYPTBASE.dll"44:T4d1,Found reference to API "WSASend" (Indicator: "WSASend"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ">g____PInvoke|186_0" (Indicator: "WinHttpOpen"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API ">g____PInvoke|186_0" (Indicator: "WinHttpOpen"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")45:T239f,Found URL "https:///" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "https://socks4:/" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://http/1." - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found URL "http://mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found URL "https://qucisg666.oss-cn-hongkong.aliyuncs.com/zh/ds.mp4" - Source: "00000000-00002136.00000000.177452.DA000000.00000004.mdmp") Found URL "http://qucisg666.oss-cn-hongkong.aliyuncs.com:443/qucisg666.oss-cn-hongkong.aliyuncs.com/zh/ds.mp4sspicli.dllsystem.net.securityc:\sspicli.dll=<5/kernel32.dllsystem.net.socketsc:\kernel32.dll(utc)" - Source: "00000000-00002136.00000000.177452.DA000000.00000004.mdmp") Found URL "https://qucisg666.oss-cn-hongkong.aliyuncs.com/zh/ds.mp4tpttptpttpppttpppttpppttpppttptnlny" - Source: "00000000-00002136.00000000.177452.DA000000.00000004.mdmp") Found URL "https://api.aliyun.com/troubleshoot?q=0003-00000905http/1.1" - Source: "00000000-00002136.00000000.177452.DA000000.00000004.mdmp") Found URL "https://api.aliyun.com/troubleshoot?q=0003-00000905oirmo+-pr3k" - Source: "00000000-00002136.00000000.177452.DA000000.00000004.mdmp")46:T726,Found registry query API: "RegEnumKeyExW" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: "RegNotifyChangeKeyValue" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: "RegQueryValueExW" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: "RegOpenKeyExW" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: "RegOpenKeyEx" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: ".RegNotifyChangeKeyValue" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: "RegEnumKeyEx" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: "RegQueryValueEx" in file "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a" Found registry query API: "RegOpenKeyEx" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found registry query API: ".RegNotifyChangeKeyValue" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found registry query API: "RegEnumKeyEx" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp"47:Ta2a,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "*LsaNtStatusToWinError>g____PInvoke|7_0" (Indicator: "LsaLookupSids"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ",LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "&LsaFreeReturnBufferPg____PInvoke|0_0" (Indicator: "LsaGetLogonSessionData"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "*LsaNtStatusToWinError>g____PInvoke|7_0" (Indicator: "LsaLookupSids"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API ",LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "&LsaFreeReturnBufferPg____PInvoke|0_0" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")48:T9fe,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "Sleep:SetThreadPoolWorkerThreadName2ResetThreadPoolThreadSlow2GetCurrentProcessorNumber@" (Indicator: "GetCurrentProcess"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "6GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ",GetCurrentProcessToken" (Indicator: "GetCurrentProcess"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "Sleep:SetThreadPoolWorkerThreadName2ResetThreadPoolThreadSlow2GetCurrentProcessorNumber@" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "6GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API ",GetCurrentProcessToken" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")49:T5d3,Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "8GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API ",NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "Rg____PInvoke|17_0" (Indicator: "QueryInformationFile"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "8GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API ",NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "Rg____PInvoke|17_0" (Indicator: "QueryInformationFile"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")4a:T451,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00002136-00000BC0-1380836859") Found string "\Device\HarddiskVolume3\8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Indicator: "\Device\"; Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp, 00000000-00002136.00000000.177452.D5B00000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002136.00000000.177452.D56B0000.00000004.mdmp, 00000000-00002136.00000000.177452.D5B00000.00000004.mdmp")4b:T752,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "RevertToSelf.ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "RevertToSelf.ImpersonateLoggedOnUser" (Indicator: "RevertToSelf"; File: "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "RevertToSelf.ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "RevertToSelf.ImpersonateLoggedOnUser" (Indicator: "RevertToSelf"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00002136.00000000.177452.C7C83000.00000002.mdmp")4c:Tdf1,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")4d:Tf6f,Found string "GetAddrInfoExCancel" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: WS2_32.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: KERNELBASE.DLL) Found string "socket" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: WS2_32.DLL) Found string "WinHttpOpen" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: WINHTTP.DLL) Found string "CryptGenKey" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: CRYPTSP.DLL) Found string "CryptGetKeyParam" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: CRYPTSP.DLL) Found string "CryptGetUserKey" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: CRYPTSP.DLL) Found string "CryptImportKey" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: CRYPTSP.DLL) Found string "BCryptHash" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: BCRYPT.DLL) Found string "HashData" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: SHLWAPI.DLL) Found string "LsaLookupSids" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: SECHOST.DLL) Found string "LsaOpenPolicy" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: SECHOST.DLL) Found string "AcceptSecurityContext" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: SSPICLI.DLL) Found string "AcquireCredentialsHandleW" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: SSPICLI.DLL) Found string "ApplyControlToken" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: SSPICLI.DLL) Found string "RtlDllShutdownInProgress" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: NTDLL.DLL) Found string "IsWow64Process2" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: KERNELBASE.DLL) Found string "QueueUserAPC2" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: KERNELBASE.DLL) Found string "RtlGetReturnAddressHijackTarget" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: NTDLL.DLL) Found string "SetThreadDescription" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: KERNELBASE.DLL) Found string "BrotliDecoderCreateInstance" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: 8B5C263809C6BE09428706FE2F4FF868C98E946ECA5072747171F278838A300A.EXE) Found string "BrotliDecoderDecompress" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: 8B5C263809C6BE09428706FE2F4FF868C98E946ECA5072747171F278838A300A.EXE) Found string "BrotliDecoderDecompressStream" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: 8B5C263809C6BE09428706FE2F4FF868C98E946ECA5072747171F278838A300A.EXE) Found string "BrotliDecoderDestroyInstance" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: 8B5C263809C6BE09428706FE2F4FF868C98E946ECA5072747171F278838A300A.EXE) Found string "BrotliDecoderErrorString" (Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a, API is part of module: 8B5C263809C6BE09428706FE2F4FF868C98E946ECA5072747171F278838A300A.EXE)4e:T10a7,"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793794352909,"unified_at":"2026-11-04T12:12:32.909Z","metadata":{"hashes":{"sha256":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","sha1":"2a50f6815165ba5b7ec30e6437add4c0da551794","md5":"1002a02464f98b165dcf800fa83f60ca","sha512":"75529746291434890b99342d2de1dc5e64d3d15a7720646898baefba02636466003a29b43cf5ee9cd370e7e598b2ce392d29dd2c5dc82a6a2f682219246585fb","ssdeep":"49152:XZpadWiWqBOv1dbcTwiGlDXWmbA1Jx6k81APXHhrajQEAZarFU4J2DiokLf941S8:XMMtc6F1E3MaiGQUAGmY02b","ssdeep_chunks":["49152:XZpadWi","49152:ZpadWiW","49152:padWiWq","49152:adWiWqB","49152:dWiWqBO","49152:WiWqBOv","49152:iWqBOv1","49152:WqBOv1d","49152:qBOv1db","49152:BOv1dbc","49152:Ov1dbcT","49152:v1dbcTw","49152:1dbcTwi","49152:dbcTwiG","49152:bcTwiGl","49152:cTwiGlD","49152:TwiGlDX","49152:wiGlDXW","49152:iGlDXWm","49152:GlDXWmb","49152:lDXWmbA","49152:DXWmbA1","49152:XWmbA1J","49152:WmbA1Jx","49152:mbA1Jx6","49152:bA1Jx6k","49152:A1Jx6k8","49152:1Jx6k81","49152:Jx6k81A","49152:x6k81AP","49152:6k81APX","49152:k81APXH","49152:81APXHh","49152:1APXHhr","49152:APXHhra","49152:PXHhraj","49152:XHhrajQ","49152:HhrajQE","49152:hrajQEA","49152:rajQEAZ","49152:ajQEAZa","49152:jQEAZar","49152:QEAZarF","49152:EAZarFU","49152:AZarFU4","49152:ZarFU4J","49152:arFU4J2","49152:rFU4J2D","49152:FU4J2Di","49152:U4J2Dio","49152:4J2Diok","49152:J2DiokL","49152:2DiokLf","49152:DiokLf9","49152:iokLf94","49152:okLf941","49152:kLf941S","49152:Lf941S8","98304:XZpadWi","98304:ZpadWiW","98304:padWiWq","98304:adWiWqB","98304:dWiWqBO","98304:WiWqBOv","98304:iWqBOv1","98304:WqBOv1d","98304:qBOv1db","98304:BOv1dbc","98304:Ov1dbcT","98304:v1dbcTw","98304:1dbcTwi","98304:dbcTwiG","98304:bcTwiGl","98304:cTwiGlD","98304:TwiGlDX","98304:wiGlDXW","98304:iGlDXWm","98304:GlDXWmb","98304:lDXWmbA","98304:DXWmbA1","98304:XWmbA1J","98304:WmbA1Jx","98304:mbA1Jx6","98304:bA1Jx6k","98304:A1Jx6k8","98304:1Jx6k81","98304:Jx6k81A","98304:x6k81AP","98304:6k81APX","98304:k81APXH","98304:81APXHh","98304:1APXHhr","98304:APXHhra","98304:PXHhraj","98304:XHhrajQ","98304:HhrajQE","98304:hrajQEA","98304:rajQEAZ","98304:ajQEAZa","98304:jQEAZar","98304:QEAZarF","98304:EAZarFU","98304:AZarFU4","98304:ZarFU4J","98304:arFU4J2","98304:rFU4J2D","98304:FU4J2Di","98304:U4J2Dio","98304:4J2Diok","98304:J2DiokL","98304:2DiokLf","98304:DiokLf9","98304:iokLf94","98304:okLf941","98304:kLf941S","98304:Lf941S8","49152:XMMtc6F","49152:MMtc6F1","49152:Mtc6F1E","49152:tc6F1E3","49152:c6F1E3M","49152:6F1E3Ma","49152:F1E3Mai","49152:1E3MaiG","49152:E3MaiGQ","49152:3MaiGQU","49152:MaiGQUA","49152:aiGQUAG","49152:iGQUAGm","49152:GQUAGmY","49152:QUAGmY0","49152:UAGmY02","49152:AGmY02b"],"imphash":"c941741b2df2e417e6644d049501200c"},"file_info":{"file_name":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":5520384,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1779649961000,"last_seen":1793794253000,"last_multi_scan":1793794253000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["keylogger"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":171,"suspicious_count":10,"malicious_count":2,"total":183},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win.MalwareX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win64.Xegumumune","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.178861","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.178861 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Agent.JJT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Lotok.qm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 006e06281 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.RJLK-8242","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win64.189605","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/Agent.JJT trojan","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Midie.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"suspicious","value":"Possibly tries to hide a process launching it with different user credentials"},{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"File Transfer Protocols","attack_id":"T1071.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/002","identifiers":[{"type":"informative","value":"Able to communicate using FTP protocol (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"[Private Key]\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"Invalid assembly public key.\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"[Public Key]\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"The server mode SSL must use a certificate with the associated private key.\" (Indicator: \"private key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1H;\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"HTTP/1.0H;\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \"The synchronous method is not supported by '{0}' for HTTP/2 or higher. Either use an asynchronous method or downgrade the request version to HTTP/1.1 or lower.\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1.\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"The HTTP/1.1 response chunk was too large.\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\", \"2.5.29.37\", \"2.5.29.17\", \"2.5.29.19\", \"2.5.29.10\", \"2.5.29.14\", \"2.5.29.15\", \"2.5.4.6\", \"2.5.4.5\", \"2.5.4.4\", \"2.5.4.3\", \"2.5.4.9\", \"2.5.4.8\", \"2.5.4.7\", \"2.5.4.10\", \"2.5.4.11\", \"2.5.4.12\", \"2.5.4.13\", \"2.5.4.18\", \"2.5.4.17\", Potential IP \"0.0.0.0\" found in string \"IPv4 address 0.0.0.0 and IPv6 address ::0 are unspecified addresses that cannot be used as a target address.\", \"2.5.4.43\", \"2.5.4.42\", \"2.5.4.46\", \"2.5.4.20\", \"2.5.4.24\", \"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://socks4\", Found HTTPS url \"https://aka.ms\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"Cannot re-call BeginGetRequestStream/BeginGetResponse while a previous call is still in progress.\" (Indicator: \"BeginGetRequestStream\"; Source: \"sample.bin\"), Found reference to API \"Cannot re-call BeginGetRequestStream/BeginGetResponse while a previous call is still in progress.\" (Indicator: \"GetRequestStream\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\UTC\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"text/javascript\" (Indicator: \"text/javascript\"; Source: \"sample.bin\"), Found string \"text/javascript; charset=UTF-8\" (Indicator: \"text/javascript\"; Source: \"sample.bin\"), Found string \"text/javascript; charset=utf-8\" (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \" kerberosCapabili Version MaxToke CommentKerberos\" (Indicator: \"kerberos\"; Source: \"sample.bin\"), Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1558","id":"string-868","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Invalid URI: The username:password construct is badly formed.\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"SOCKS server requested username & password authentication.\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Invalid URI: The hostname could not be parsed.\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"The HTTP/2 server didn't respond to a ping request within the configured KeepAlivePingDelay.\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"hostName\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"Experimental.System.Net.NameResolution.DnsLookup\" (Indicator: \"nslookup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-430","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"OSVersion's call to GetVersionEx failed.\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoExCancel\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"Observed string: \"sftp\" (Indicator: \"sftp\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-578","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queried SystemProcessInformation at 00000000-00002136-00000C15-1381967831 [PID: 2136]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queried SystemProcessInformation at 00000000-00002136-00000C15-1381975340 [PID: 2136]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queried SystemProcessInformation at 00000000-00002136-00000C15-1382194849 [PID: 2136]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queried SystemProcessInformation at 00000000-00002136-00000C15-1382201852 [PID: 2136]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queried SystemProcessInformation at 00000000-00002136-00000C15-1382459640 [PID: 2136]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queried SystemProcessInformation at 00000000-00002136-00000C15-1382467957 [PID: 2136]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \".QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 763-16549-00000001402BDCC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKeyPair\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found api reference \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKeyPair\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$30","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String$TryFromBase64Chars\" (Indicator: \"FromBase64String\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"FromBase64String$TryFromBase64Chars\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"Bg____PInvoke|19_0\" (Indicator: \"EncryptMessage\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"EncryptMessage@\" (Indicator: \"EncryptMessage\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"Bg____PInvoke|19_0\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"EncryptMessage@\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"Bg____PInvoke|20_0\" (Indicator: \"DecryptMessage\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"DecryptMessage@\" (Indicator: \"DecryptMessage\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"Bg____PInvoke|20_0\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"DecryptMessage@\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptGenKey\" (Indicator: \"CryptGenKey\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"CryptGetUserKey\" (Indicator: \"CryptGetUserKey\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002136.00000000.177452.D56B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"hongkong\" in header \"GET /zh/ds.mp4 HTTP/1.1Host: qucisg666.oss-cn-hongkong.aliyuncs.comConnection: Keep-Alive\"\n Contains base64 string in header \"aliyuncs\" in header \"GET /zh/ds.mp4 HTTP/1.1Host: qucisg666.oss-cn-hongkong.aliyuncs.comConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /zh/ds.mp4 HTTP/1.1Host: qucisg666.oss-cn-hongkong.aliyuncs.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$34","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$35","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136-00000C2C-1382765285\")\n Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_OSVersion\" (Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found string \"GetOSVersion4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool\" (Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found string \"\"get_VersionString$IsOSVersionAtLeast\" (Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136-00000C2C-1382765285\")\n Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002136)\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002136)\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GlobalMemoryStatusEx@KERNEL32.dll at 763-16832-0000000140235DA0\n GlobalMemoryStatusEx@KERNEL32.dll at 763-16833-0000000140235BC0\n GlobalMemoryStatusEx@KERNEL32.dll at 763-16834-00000001402359D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 763-38070-00000001402BDB1A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 763-38070-00000001402BDB1A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver call this method.\" (Indicator: \"ver \") in Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 763-16556-00000001402BCA40\n OpenProcessToken@ADVAPI32.dll at 763-16830-00000001402363C0\n OpenProcessToken@ADVAPI32.dll at 763-38265-00000001402BCB23","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queried token user identity (UID: 00000000-00002136)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\" (SID: 2052581, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$39","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"qucisg666.oss-cn-hongkong.aliyuncs.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"47.79.66.211:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\xdd\\bin\\Release\\net10.0\\win-x64\\native\\Update.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"\"CreateFilePrivate\" (Indicator: \"CreateFile\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\"), Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\"), Found reference to API \"\"CreateFilePrivate\" (Indicator: \"CreateFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SleepEx@KERNEL32.dll at 763-16582-00000001402695D0\n SleepEx@KERNEL32.dll at 763-16700-0000000140236210\n WaitForSingleObject@KERNEL32.dll at 763-16828-0000000140236580","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.dll at 763-16714-0000000140225B20\n LoadLibraryExW@KERNEL32.dll at 763-26502-000000014022F9E1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3d","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2136:304:WilStaging_02\"\n Process 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2136:304:WilStaging_02\"\n Process 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe created mutex with name \"SM0:2136:304:WilStaging_02\"\n Process 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe created mutex with name \"Local\\SM0:2136:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" failed to load missing module \"C:\\winhttp.dll\" - [base:0; Status:c0000135]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" failed to load missing module \"C:\\ntdll.dll\" - [base:0; Status:c0000135]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" failed to load missing module \"C:\\sspicli.dll\" - [base:0; Status:c0000135]\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" failed to load missing module \"C:\\kernel32.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"dsystem.collections.specialized.dll@system.componentmodel.primitives\"\n Pattern match: \"y@system.gc.heapaffinitizeranges\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"twitter\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002136.00000000.177452.DA000000.00000004.mdmp\n \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002136.00000000.177452.DA000000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Pacific Standard Time\" in Source: 00000000-00002136.00000000.177452.DA000000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Pacific Standard Time\\Dynamic DST\" in Source: 00000000-00002136.00000000.177452.DA000000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET /zh/ds.mp4 HTTP/1.1\nHost: qucisg666.oss-cn-hongkong.aliyuncs.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 403 Forbidden\nServer: AliyunOSS\nDate: Wed\n 04 Nov 2026 12:11:24 GMT\nContent-Type: application/xml\nContent-Length: 334\nConnection: keep-alive\nx-oss-request-id: 6AEB20ECAC88A132305AB3BF\nx-oss-ec: 0003-00000905 with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E0A3C4572726F723E0A20203C436F64653E41636365737344656E.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FBA90000\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FC560000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FE210000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1402bdb00,add\trsp, 0x28,jmp\t0x1402bd070,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,cmp\tedx, 2,jne\t0x1402bd275,mov\tqword ptr [rsp + 8], rbx,push\trdi,sub\trsp, 0x20,mov\tecx, dword ptr [rip + 0x259d2b],mov\trax, qword ptr gs:[0x58],mov\tedx, 0x120,mov\trax, qword ptr [rax + rcx*8],cmp\tbyte ptr [rax + rdx], 1,je\t0x1402bd26b,mov\tbyte ptr [rax + rdx], 1,lea\trbx, [rip + 0x16740],lea\trdi, [rip + 0x16741],cmp\trbx, rdi,je\t0x1402bd26b,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2d1e00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x1ed400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2d1c48\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1ed392\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00002136-00000BC0-1380836859]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"qucisg666.oss-cn-hongkong.aliyuncs.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign GCC R3 OV TLS CA 2024, O=GlobalSign nv-sa, C=BE\" (SHA1: 07:DD:45:99:F9:D3:55:D6:EB:41:00:22:C7:FA:B0:8F:DB:0B:E9:4C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (SHA1: 73:28:B0:27:C7:E2:13:9E:E3:BA:57:B5:28:CD:B3:57:F8:E3:B9:D0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 0B:BF:AB:97:05:95:95:E8:D1:EC:48:E8:9E:B8:65:7C:0E:5A:AE:71; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" queries basic process information of the \"C:\\8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (UID: 2136)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"\n \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Able to communicate using FTP protocol (.NET)","description":"Found string \"FtpWebResponse+\" (Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found string \"(EnsureFtpWebResponse DataStreamClosed@\" (Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.002","relevance":1,"id":"string-944","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"SetSockOpt\" (Indicator: \"setsockopt\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"SetSockOpt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /zh/ds.mp4\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"Found reference to API \",System.Net.Sockets.dll(System.Net.WebClient\" (Indicator: \"System.Net.WebClient\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"0System.Net.WebClient.dllg____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"RtlGetVersionEx\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"@g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \",LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"&LsaFreeReturnBufferPg____PInvoke|0_0\" (Indicator: \"GetLogonSessionData\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \",LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"&LsaFreeReturnBufferPg____PInvoke|0_0\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"0GetProcAddressWithSuffix\" (Indicator: \"GetProcAddress\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetProcAddress&CancelSynchronousIo\" (Indicator: \"GetProcAddress\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"0GetProcAddressWithSuffix\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"GetProcAddress&CancelSynchronousIo\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"FailFast,GetEnvironmentVariable4ExpandEnvironmentVariables\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"GetOSVersion4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"DeleteFile@\" (Indicator: \"DeleteFile\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"DeleteFile@\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"$CancelThreadpoolIo\"DeleteFilePrivate\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\"), Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\n Observed string: \"Shutdown TryReserveStream\" (Indicator: \"shutdown \") in Source: 00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002136.00000000.177452.C7C83000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002136.00000000.177452.C7C83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"7)]\"), \"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a]\n Observed import api \"ImpersonateLoggedOnUser\" which can \"let the calling thread impersonate the security context of a logged-on user\" [Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: 8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"7)]\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00002136.00000000.177452.D56B0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Possibly tries to hide a process launching it with different user credentials","description":"ImpersonateLoggedOnUser@ADVAPI32.dll at 763-18650-00000001402BCB1D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.002","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/24 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"SuspendThread@KERNEL32.dll at 763-16714-0000000140225B20\n SetThreadContext@KERNEL32.dll at 763-16719-000000014022FB00\n GetThreadContext@KERNEL32.dll at 763-16720-000000014022F410\n OpenThread@KERNEL32.dll at 763-37796-00000001402BCD7B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 47.79.66.211 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueW@ADVAPI32.dll at 763-16830-00000001402363C0\n GetTokenInformation@ADVAPI32.dll at 763-24590-00000001402BCB17","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"ImpersonateLoggedOnUser@ADVAPI32.dll at 763-18650-00000001402BCB1D\n RevertToSelf@ADVAPI32.dll at 763-18652-00000001402BCB59\n GetTokenInformation@ADVAPI32.dll at 763-24590-00000001402BCB17","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a\" has a TLS callback with entrypoint at 0x1402bd210","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegEnumKeyExW\n OpenProcessToken\n RegOpenKeyExW\n RegCloseKey\n LoadLibraryW\n GetModuleHandleExW\n CreateFileW\n DeviceIoControl\n GetSystemInfo\n CreateThreadpoolWork\n DeleteFileW\n VirtualAllocExNuma\n Sleep\n CreateThreadpoolIo\n SleepEx\n CreateThreadpoolTimer\n SleepConditionVariableCS\n GetModuleHandleW\n WriteFile\n CreateThreadpoolWait\n LoadLibraryExW\n CreateThread\n GetModuleFileNameW\n GetProcAddress\n IsDebuggerPresent\n GetTickCount64\n VirtualAlloc\n GetThreadContext\n WSASend\n accept\n recv\n listen\n WSAStartup\n send\n bind\n WSASocketW\n closesocket","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}],"intel_graph":{"map":{"Domain:qucisg666.oss-cn-hongkong.aliyuncs.com":{"type":"Domain","value":"qucisg666.oss-cn-hongkong.aliyuncs.com"},"File:8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a":{"type":"File","value":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file"]}},"Ip:47.79.66.211":{"type":"Ip","value":"47.79.66.211"},"Url:/zh/ds.mp4":{"type":"Url","value":"/zh/ds.mp4"}},"chains":[{"id":"1567511461269546945","root":"File:8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file"]}},{"id":"sandbox_network","root":"File:8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","edges":[{"edge_kind":"contacted_ip","from_key":"File:8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","to_key":"Ip:47.79.66.211"},{"edge_kind":"contacted_domain","from_key":"File:8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","to_key":"Domain:qucisg666.oss-cn-hongkong.aliyuncs.com"},{"edge_kind":"resolves_to","from_key":"Domain:qucisg666.oss-cn-hongkong.aliyuncs.com","to_key":"Ip:47.79.66.211"},{"edge_kind":"contacted_url","from_key":"File:8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","to_key":"Url:/zh/ds.mp4"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["keylogger"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6aeb20cb751145548409fe11","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Midie","contacted_countries":["HKG"],"submit_name":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","analysis_start_time":"2026-11-04T12:10:53+00:00","indicators_count":{"informative":170,"suspicious":25,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"47.79.66.211","port":443,"protocol":"TCP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}],"dns_resolutions":[{"domain":"qucisg666.oss-cn-hongkong.aliyuncs.com","address":"47.79.66.211","ttl":60,"country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}],"http_requests":[{"host":"qucisg666.oss-cn-hongkong.aliyuncs.com","host_ip":"47.79.66.211:443","url":"/zh/ds.mp4","method":"GET","response_code":"403","response_phrase":"Forbidden","header":"GET /zh/ds.mp4 HTTP/1.1\nHost: qucisg666.oss-cn-hongkong.aliyuncs.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}],"processes":[{"pid":2136,"ppid":0,"name":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe","command_line":"","sha256":"8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a","normalized_path":"C:\\8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a.exe","uid":"00000000-00002136","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="}],"all_imported_dlls":["ws2_32.dll","schannel.dll","kernel32.dll","sechost.dll","bcrypt.dll","msvcp_win.dll","gdi32.dll","bcryptprimitives.dll","nsi.dll","dnsapi.dll","msvcrt.dll","ncrypt.dll","gdi32full.dll","combase.dll","dhcpcsvc.dll","OnDemandConnRouteHelper.dll","KernelBase.dll","rpcrt4.dll","oleaut32.dll","winhttp.dll","FWPUCLNT.DLL","ncryptsslp.dll","msasn1.dll","rsaenh.dll","ucrtbase.dll","ole32.dll","ntasn1.dll","VxSSL64.dll","vcruntime140.dll","kernel.appcore.dll","cryptbase.dll","gpapi.dll","win32u.dll","user32.dll","shlwapi.dll","dhcpcsvc6.dll","rasadhlp.dll","sspicli.dll","imm32.dll","fltLib.dll","msvcp140.dll","vcruntime140_1.dll","ntdll.dll","apphelp.dll","crypt32.dll","IPHLPAPI.DLL","advapi32.dll","cryptsp.dll","mswsock.dll","wshunix.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"name":"SM0:2136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]},{"name":"Local\\SM0:2136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb20cb751145548409fe11"}]}]}},"report_ids":{"sandbox_job_ids":["6aeb20cb751145548409fe11"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win64/Agent.JJT trojan Sample 8b5c263809c6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8b5c263809c6…. Malware family: Win64/Agent.JJT trojan. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/Agent.JJT trojan Sample 8b5c263809c6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8b5c263809c6…. Malware family: Win64/Agent.JJT trojan. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/Agent.JJT trojan Sample 8b5c263809c6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8b5c263809c6…. Malware family: Win64/Agent.JJT trojan. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]