26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Rasftuby.Generic Sample 8e820fb8e770… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample 8e820fb8e770…. Malware family: Trojan.Rasftuby.Generic. Threat score 89/100. 11/26 AV engines flagged this file. 8 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0","keywords":["Malicious","Trojan.Rasftuby.Generic","malware analysis","sandbox report","threat intelligence","8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0"],"about":{"@type":"SoftwareApplication","name":"8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"Trojan.Rasftuby.Generic","antivirusDetections":{"malicious":11,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb48,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002632.00000000.157752.00E2F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002632.00000000.157752.00E2F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003060.00000000.157428.00E2F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003060.00000000.157428.00E2F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003368.00000000.153069.0105E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003368.00000000.153069.0105E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp")28:T457,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp")29:Tbd0,Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001080.00000000.156780.03450000.00000004.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002156.00000000.158076.00B60000.00000004.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003060.00000000.157428.03450000.00000004.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004492.00000000.158725.03250000.00000004.mdmp")2a:T4fb,Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "OpenService" (Indicator: "OpenService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "artService: OpenService" (Indicator: "OpenService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "OpenService" (Indicator: "OpenService"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp")2b:Tf61,"Windows Connect Now" (Indicator: " connect "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp")59:T60a,"192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"5a:Tb1a,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "w_.pw" Heuristic match: "km.ad" Heuristic match: "}k.tg" Heuristic match: "ea.de" Heuristic match: "tv.se" Heuristic match: "b<.pf" Heuristic match: "m8.wf" Pattern match: "www.nirsoft.netopenif" Heuristic match: "%windir%\syswow64\chcp.com" Heuristic match: "%windir%\syswow64\mode.com" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "%windir%\system32\mode.com" Heuristic match: "ms@.ms" Heuristic match: "be;.js;.jse;.ws" Heuristic match: ".exe svchost.ec" Heuristic match: "xe shellexperiencehost.exe searchui.exe runtimebroker.exe runtimebroker.exe svchost.exe svchost.et" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "pathext=.cc" Pattern match: "http://schemas.microsoft.com/smi/2011/windowssettings" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = '" - Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found URL "https://www.nirsoft.netopenif" - Source: "00000000-00007076.00000000.147824.40017000.00000002.mdmp") Found URL "http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.netntdll.dllntquerysysteminformationntloaddriverntunloaddriverntopensymboliclinkobjectntquerysymboliclinkobjectntqueryobjectntsuspendprocessntresumeprocesslookupprivilegevalueaadjusttokenprivilegesseshutdownprivilegeinitiatesystemshutdownaabortsystemshutdownalockworkstationsetsystempowerstaterasdlg.dllrasdialdlgawininet.dllinternetdialanetapi32.dllnetschedulejobaddnetremotetodnetapibufferfreecreatetoolhelp32snapshotmodule32firstmodule32nextprocess32firstprocess32nextpsapi.dllgetmodulebasenameaenumprocessmodulesgetmodulefilenameexaenumprocessesgetmoduleinformation\systemrootqueryfullprocessimagenamearasapi32.dllrassetentrydialparamsarasenumconnectionsarasgetconnectstatusarashanguparasgetentrydialparamsarasdialahkey_local_machinehklmhkey_current_userhkcuhkey_classes_roothkcrhkey_usershkey_current_confighkccsyslistview32systreeview32regedit_regeditregedit.exeopenscmanageraopenserviceachangeserviceconfigacloseservicehandlequeryserviceconfigacontrolserviceenumservicesstatusastartserviceaqueryservicestatusservicesactiveshell32.dllshgetspecialfolderpathashemptyrecyclebinafavoritesrecentcookiesappdatadesktopstart" - Source: "00000000-00007076.00000000.147824.40017000.00000002.mdmp")5c:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp")5d:T13bb,Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp") Found string "The WinRM service supports the following profiles: Negotiate or Kerberos over HTTP, Negotiate or Kerberos over HTTPS, and mutual certificate authentication over HTTPS using issuer thumbprints." (Indicator: "kerberos"; Source: "00000000-00005092.00000001.149370.048D0000.00000002.mdmp")5e:T6b5,Found registry query API: "RegOpenKeyExW" in file "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin" Found registry query API: "RegQueryValueExW" in file "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin" Found registry query API: "RegQueryValueExW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00003368.00000000.153069.0105E000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003916.00000000.155418.01171000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003916.00000000.155418.01171000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005092.00000001.149370.00A13000.00000002.mdmp"5f:T78a,"nulColor 0fset "SCRIPT_RUNNING_FLAG=%TEMP%\script_running_%RANDOM%.tmp"if exist "%SCRIPT_RUNNING_FLAG%" exit /becho.> "%SCRIPT_RUNNING_FLAG%"set "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || ( nircmd elevate "%~f0" del "%SCRIPT_RUNNING_FLAG%" 2>nul exitif defined WT_SESSION ( reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nul reg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1set "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerset "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1 taskkill /f /im mika.exe >nul 2>&1 start "" /min mika.exe /DelWD echo.> "%DEFENDER_REMOVED_FLAG%"del "%SCRIPT_RUNNING_FLAG%" 2>nulexit /b" (Indicator: ""del ") in Source: vCHyP0aU8.bat6c:T1044,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00005092.00000000.149321.00A01000.00000020.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "00000000-00003368.00000000.153069.01011000.00000020.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003368.00000000.153069.01011000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003368.00000000.153069.0105E000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003368.00000000.153069.0105E000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005092.00000000.149321.00A01000.00000020.mdmp, 00000000-00005092.00000000.149321.02E20000.00000004.mdmp, 00000000-00005092.00000001.149370.02E43000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp")6d:T61d,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002632.00000000.157752.00E2F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003060.00000000.157428.00E2F000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00003916.00000000.155418.01171000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00004492.00000000.158725.00E21000.00000020.mdmp")6e:T4fe,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002632.00000000.157752.00E2F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003060.00000000.157428.00E2F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003368.00000000.153069.0105E000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003368.00000000.153069.0105E000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005092.00000001.149370.00A13000.00000002.mdmp")6f:Tf4f,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "8e820fb8e770c150d02b436714af5e1c1e09d46d20f3082262db9faa30ed3cf0.bin") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00003916.00000000.155418.010C1000.00000020.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00001932.00000000.151772.03170000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00002412.00000000.149821.00F10000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003368.00000000.153069.01011000.00000020.mdmp") Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "00000000-00003796.00000000.150799.034D0000.00000004.mdmp")70:T4e7,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "FFD5FA8943BEDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "009A6A8D43BEDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "F9FFE6C243BEDC010000000000000000000000000200000000") "mika.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "L�(") "mika.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EA56A9CF43BEDC010000000000000000000000000200000000")71:Tb20,"