24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dump:Generic.Trojan.TangoStealer.Marte.A Sample 904a3d70be9f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 904a3d70be9f…. Malware family: Dump:Generic.Trojan.TangoStealer.Marte.A. Threat score 100/100. 16/27 AV engines flagged this file. 15 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133","keywords":["Malicious","Dump:Generic.Trojan.TangoStealer.Marte.A","malware analysis","sandbox report","threat intelligence","904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133"],"about":{"@type":"SoftwareApplication","name":"payload.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dump:Generic.Trojan.TangoStealer.Marte.A","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7cc,Found reference to API "WriteProcessMemory64From32" (Indicator: "WriteProcessMemory"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "[-] VirtualAlloc failed" (Indicator: "VirtualAlloc"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "[-] CreateThread failed" (Indicator: "CreateThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe")26:Tdab,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetObjectForIUnknown" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeBSTR" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SystemMaxDBCSCharSize" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "OffsetOf" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt16" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReAllocHGlobal" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe"27:T4ef,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "SystemQueryPerformanceCounterInformation" (Indicator: "QueryPerformanceCounter"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp")28:Tc4c,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "TripleDES" (Indicator: "TripleDES"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "AesManaged" (Indicator: "Aes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "AesManaged" (Indicator: "AesManaged"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "AesGcm" (Indicator: "Aes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "AesGcm" (Indicator: "AesGcm"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001548-00000BC0-3459562092")29:Td51,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3456717663 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3456724337 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3457527750 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3457535732 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3460775246 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3460782396 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3461155946 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3461165418 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3471304013 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3471311320 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3499486364 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3499493078 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3500832815 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3500839556 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3505783686 [PID: 1548] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queried SystemProcessInformation at 00000000-00001548-00000C15-3505790392 [PID: 1548] "cmd.exe" queried SystemProcessInformation at 00000000-00004332-00000C15-3484425696 [PID: 4332] "cmd.exe" queried SystemProcessInformation at 00000000-00004332-00000C15-3484432820 [PID: 4332] "cmd.exe" queried SystemProcessInformation at 00000000-00004332-00000C15-3484904162 [PID: 4332] "cmd.exe" queried SystemProcessInformation at 00000000-00004332-00000C15-3484911197 [PID: 4332] "netsh.exe" queried SystemProcessInformation at 00000000-00004128-00000C15-3485652482 [PID: 4128] "netsh.exe" queried SystemProcessInformation at 00000000-00004128-00000C15-3485660304 [PID: 4128] "netsh.exe" queried SystemProcessInformation at 00000000-00004128-00000C15-3486160031 [PID: 4128] "netsh.exe" queried SystemProcessInformation at 00000000-00004128-00000C15-3486166932 [PID: 4128] "netsh.exe" queried SystemProcessInformation at 00000000-00004128-00000C15-3487425044 [PID: 4128]2a:T7c2,Found api reference "_BCryptImportKey_KeyDataBlob" (Indicator: "BCryptImportKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "_BCryptImportKey_KeyDataBlob" (Indicator: "CryptImportKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00003964.00000000.293682.6ED43000.00000004.mdmp")2b:T4c3,Found reference to API "_BCryptImportKey_KeyDataBlob" (Indicator: "CryptImportKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe")2c:T946,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match – Encryption algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform AES encryption (Dotnet String) Matched sigs: Contains cryptographic functions of the CryptoAPI Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2d:T4d6,Found XOR loop in file "sample.bin" at offset 140837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 157259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 374838; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 400814; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 547066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 133925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 237944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 297907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 321719; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 440845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 495184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 86745; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 113809; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 466861; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 487115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 571797; code bytes = 80302e:Taee,Found reference to API "d__1" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "d__2" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "d__3" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "d__5" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "d__7" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "SendMessageAsync" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "SendMessageInfoAsync" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "+Stub.DiscordSendLogs+d__2" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "/Stub.DiscordSendLogs+d__3" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "'Stub.FtpSendLogs+d__5" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "+Stub.FtpSendLogs+d__7" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API ",Stub.TelegramSendLogs+d__2" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "0Stub.TelegramSendLogs+d__3" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "'Stub.UploadToFtp+d__1" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "Discord >> SendMessage exception:\n" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "/sendMessage?chat_id=" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "Telegram >> SendMessage exception:\n" (Indicator: "sendmessage"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe")2f:Tabe,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000028eadef1fa00000018000000fa0000001d3f47f0024200001f98e214360200000a00000000000000c0e9def1fa0000007055e11436020000f095e214360200001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000008921fc7f0000a82f619797110000e0468921fc7f00002098e2143602000098068a21fc7f0000b081e2143602000000006d21fc7f00000000000000000000e0468921fc7f00000300000000000000f385ab23fc7f00006e478921fc7f00002766ab23fc7f000000eadef1 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938fa20fc7f000080000000000000000000000000000000d03fed14360200001033ae23fc7f0000000000000000000000004c2f3602000080bddef1fa0000001041f720fc7f00003025eb143602000040bddef1fa000000000000000000000000000000000000000100000000000000b840f720fc7f00000000000000000000010000000000000000004c2f360200003b4d3621fc7f00000000000000000000f8c1def1fa0000000000000000000000d02a5e2f3602000010b3c42f36020000e8f8f620fc7f000010b3c42f36020000d02a5e2f360200000d000000360200000d00000000000000a0f6b42f36020000f587592f36020000d02a5e2f (UID: 00000000-00001548)30:T287e,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000d4d77ff2fa0000002014e01636020000c4d77ff2fa0000008000000000000000000000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000020000681edc2f3602000000000000000000000300000000000000ffffffff000000002014e01636020000e8d97ff2fa000000100000000000000050d97ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000070da7ff2fa0000000000000000000000ffffffff00000000a0c2eb16360200002014e0163602000070da7ff2fa000000c08feb1636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000d4d77ff2fa0000002014e01636020000c4d77ff2fa0000008000000000000000000000000000000024f01cf6fb7f00000000000000000000100000000000000000000000000000000000de2f3602000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000002000068f1de2f3602000000000000000000000300000000000000ffffffff000000002014e01636020000e8d97ff2fa000000100000000000000050d97ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000070da7ff2fa0000000000000000000000ffffffff0000000070e9eb16360200002014e0163602000070da7ff2fa000000c08feb1636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000074e57ff2fa0000002014e0163602000064e57ff2fa0000008000000000000000000000000000000024f01cf6fb7f00000000000000000000100000000000000000000000000000000000de2f3602000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000020000b80bdc2f3602000000000000000000000300000000000000ffffffff000000002014e0163602000088e77ff2fa0000001000000000000000f0e67ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000010e87ff2fa0000000000000000000000ffffffff0000000018440117360200002014e0163602000010e87ff2fa0000009820e41636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000002000028f3de2f3602000000000000000000000300000000000000ffffffff000000002014e0163602000088e77ff2fa0000001000000000000000f0e67ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000010e87ff2fa0000000000000000000000ffffffff00000000a8690117360200002014e0163602000010e87ff2fa0000009820e41636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000054e77ff2fa0000002014e0163602000044e77ff2fa0000008000000000000000000000000000000024f01cf6fb7f00000000000000000000100000000000000000000000000000000000ea2f3602000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000020000681edc2f3602000000000000000000000300000000000000ffffffff000000002014e0163602000068e97ff2fa0000001000000000000000d0e87ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000f0e97ff2fa0000000000000000000000ffffffff00000000008c0417360200002014e01636020000f0e97ff2fa0000009820e41636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000054e77ff2fa0000002014e0163602000044e77ff2fa0000008000000000000000000000000000000024f01cf6fb7f00000000000000000000100000000000000000000000000000000000e52f3602000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000002000028f3de2f3602000000000000000000000300000000000000ffffffff000000002014e0163602000068e97ff2fa0000001000000000000000d0e87ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000f0e97ff2fa0000000000000000000000ffffffff0000000090b10417360200002014e01636020000f0e97ff2fa0000009820e41636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000044e77ff2fa0000002014e0163602000034e77ff2fa0000008000000000000000000000000000000024f01cf6fb7f00000000000000000000100000000000000000000000000000000000de2f3602000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000020000b80bdc2f3602000000000000000000000300000000000000ffffffff000000002014e0163602000058e97ff2fa0000001000000000000000c0e87ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000e0e97ff2fa0000000000000000000000ffffffff00000000d0882517360200002014e01636020000e0e97ff2fa0000007012e41636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000044e77ff2fa0000002014e0163602000034e77ff2fa0000008000000000000000000000000000000024f01cf6fb7f00000000000000000000100000000000000000000000000000000000ea2f3602000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000002000028f3de2f3602000000000000000000000300000000000000ffffffff000000002014e0163602000058e97ff2fa0000001000000000000000c0e87ff2fa00000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000036e2fb7f000010000000000000006f5b4e07fc7f000000000000 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000e0e97ff2fa0000000000000000000000ffffffff0000000060ae2517360200002014e01636020000e0e97ff2fa0000007012e41636020000030000000000000024f01cf6fb7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b4e07fc7f0000ffffffff (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000000000000000000c4e87ff2fa0000002014e01636020000b4e87ff2fa0000008000000000000000000000000000000024f01cf6fb7f00000000000000000000100000000000000000000000000000000000ea2f3602000010000000000000006f5b4e07fc7f00002014e016 (UID: 00000000-00001548)31:Tcf4,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "")32:T9b6,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")33:T87a,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" at 00000000-00001548-00000C17-3459574616 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00001548-00000C17-3474486131 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00001548-00000C17-3474497704 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00001548-00000C17-3474508124 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00001548-00000C17-3474545535 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00001548-00000C17-3475919452 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001548-00000C17-3476596613 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001548-00000C17-3476790074 "netsh.exe" queries volume information of "C:\" at 00000000-00004128-00000C17-3487808010 "netsh.exe" queries volume information of "C:\" at 00000000-00003964-00000C17-349379727234:Tb85,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TESTSIGNROOT"; Key: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TESTSIGNROOT\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "22FF89586561FC2D52F77491E9F1EFF1B80BE33E") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8"; Key: "BLOB") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL")35:T4e88,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\00d77e4f6209222f01fba5b5ee335b0e\System.Runtime.Serialization. (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter C:\msvcrt.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\cbb406cb22d15d17f35c72a00f7b903c\System.Net.Http.ni.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001548) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004332) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004332) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004332) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004332) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004128) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004128) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004128) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004128) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00004128) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00004128) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004128) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005304) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005304) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005304) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005304) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003964) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003964) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003964) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003964) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003964) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003964) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003964)36:T44c,"costura.costura.dll.compressed|5.7.0.0|Costura, Version=5.7.0.0, Culture=neutral, PublicKeyToken=null|Costura.dll|F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906|4608costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608costura.newtonsoft.json.dll.compressed|13.0.0.0|Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed|Newtonsoft.Json.dll|1E76E6099570EDE620B76ED47CF8D03A936D49F8|711952costura.icsharpcode.sharpziplib.dll.compressed|1.3.3.11|ICSharpCode.SharpZipLib, Version=1.3.3.11, Culture=neutral, PublicKeyToken=1b03e6acf1164f73|ICSharpCode.SharpZipLib.dll|EDF2AB9EE284FA21DBB55E93D082848E800F068B|204800costura.icsharpcode.sharpziplib.pdb.compressed|||ICSharpCode.SharpZipLib.pdb|797D83BFE6A654FE21916806E6CA7BCBB3B4C3FB|102612costura.system.diagnostics.diagnosticsource.dll.compressed|4.0.1.0|System.Diagnostics.DiagnosticSource, Version=4.0.1.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51|System.Diagnostics.DiagnosticSource.dll|85DC92EDD" "costura.costura.pdb.compressed" "costura.icsharpcode.sharpziplib.pdb.compressed"37:T5b7f,Found reference to API (Indicator: "CreateFileMappingA"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "OpenServiceW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "ChangeServiceConfigW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CreateProcessWithTokenW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CreateDesktopW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "OpenDesktopW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CreateProcessW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetClipboardData"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "SetClipboardData"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetThreadId"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "NtSuspendThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "NtResumeThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CreateThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CreateRemoteThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetProcessIdOfThread"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CloseClipboard"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "OpenClipboard"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CredFree"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GlobalFree"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "VirtualFree"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetModuleHandle"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CloseHandle"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "LdrGetDllHandle"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "AllocConsole"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetFileType"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CoUninitialize"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "RevertToSelf"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetTempPath"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GlobalLock"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "IsProcessCritical"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "LdrLoadDll"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "LdrUnloadDll"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "Sleep"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CloseDesktop"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "SetLastError"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "IsWow64Process"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "TerminateProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "OpenProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetProcAddress"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "LdrGetProcedureAddress"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetWindowRect"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "NtWaitForSingleObject"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "VirtualProtect"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BCryptDecrypt"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "NtCreateThreadEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "SetWindowsHookEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BCryptImportKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BCryptDestroyKey"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "FreeLibrary"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "CreateDirectory"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "SetCurrentDirectory"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BCryptGetProperty"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BCryptSetProperty"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "Local State"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "HeapAlloc"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "HeapFree"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp, 00000000-00003964.00000000.293682.6ED43000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp, 00000000-00003964.00000000.293682.6ED43000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00003964.00000000.293682.6ED43000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003964.00000000.293682.6ED43000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00003964.00000000.293682.6ED43000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleActiveScreenBuffer"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "RtlGUIDFromString"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp")38:T422,Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "set_Attributes" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.IO.File" and MemberReference "SetCreationTime" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTime" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe"39:Td92,"SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "\BraveSoftware\Brave-Browser\User Data" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "\Opera Software\Opera Stable" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "\Opera Software\Opera Neon\User Data" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "\Opera Software\Opera Crypto Developer" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "\Opera Software\Opera GX Stable" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "\AVAST Software\Browser\User Data" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "HARDWARE\Description\System\CentralProcessor\0" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe "SOFTWARE\\Microsoft\\Cryptography" in Source: 6000021-AntiAnalysis~SuspiciousMachineGuid "SOFTWARE\\Classes\\Foxmail.url.mailto\\Shell\\open\\command" in Source: 6000110-FoxMail~GetFoxMailLocation "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "\\BraveSoftware\\Brave-Browser\\User Data" in Source: 60001e9-cctor "\\Opera Software\\Opera Stable" in Source: 60001e9-cctor "\\Opera Software\\Opera Neon\\User Data" in Source: 60001e9-cctor "\\Opera Software\\Opera Crypto Developer" in Source: 60001e9-cctor "\\Opera Software\\Opera GX Stable" in Source: 60001e9-cctor "\\AVAST Software\\Browser\\User Data" in Source: 60001e9-cctor "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000256-Startup~IsInstalled "SOFTWARE\\Clients\\StartMenuInternet" in Source: 60002d4-Utils~GetInstalledBrowsers "SOFTWARE\\WOW6432Node\\Clients\\StartMenuInternet" in Source: 60002d4-Utils~GetInstalledBrowsers "Software\\Martin Prikryl\\WinSCP 2\\Configuration\\Security" in Source: 60002f9-WinScp~GetInfo "Software\\Martin Prikryl\\WinSCP 2\\Sessions" in Source: 60002f9-WinScp~GetInfo "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft" in Source: 00000000-00003964.00000000.293682.6ED43000.00000004.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00004128.00000000.293262.4139C000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00004128.00000000.293262.4139C000.00000002.mdmp3a:T849,Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1548:304:WilStaging_02" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1548:120:WilError_03" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "\BaseNamedObjects\RasPbFile" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "Local\SM0:1548:120:WilError_03" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "Local\SM0:1548:304:WilStaging_02" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "PHTKFN2EQRWVHV8VC14M" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "SM0:1548:120:WilError_03" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1548:120:WilError_03" Process 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe created mutex with name "\Sessions\1\BaseNamedObjects\PHTKFN2EQRWVHV8VC14M" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4332:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:4332:304:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4128:304:WilStaging_02" Process netsh.exe created mutex with name "\BaseNamedObjects\RasPbFile" Process netsh.exe created mutex with name "Local\SM0:4128:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5304:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:5304:304:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3964:304:WilStaging_02" Process netsh.exe created mutex with name "Local\SM0:3964:304:WilStaging_02"3b:T1073,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "C:\msvcrt.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]3c:T980,Observed unmanaged function "GetModuleHandle" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "BCryptOpenAlgorithmProvider" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "BCryptCloseAlgorithmProvider" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "BCryptGetProperty" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "BCryptSetProperty" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "BCryptImportKey" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "BCryptDestroyKey" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "BCryptDecrypt" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "OpenClipboard" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "CloseClipboard" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "GetClipboardData" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "IsClipboardFormatAvailable" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "GlobalLock" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "GlobalUnlock" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "EmptyClipboard" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "SetClipboardData" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "GlobalAlloc" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "GlobalFree" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "VirtualAlloc" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed unmanaged function "CreateThread" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe"3d:T520c,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "KERNEL32" at base 7ffc23100000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc23520000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbf74c0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "ADVAPI32.DLL" at base 7ffc23730000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffbf6250000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "SHLWAPI.DLL" at base 7ffc21920000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc1ff00000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "VERSION.DLL" at base 7ffc16f10000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffbe1c30000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "USER32.DLL" at base 7ffc23580000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "MSCOREE.DLL" at base 7ffbf7930000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "NTDLL" at base 7ffc23a90000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffc22090000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "PSAPI.DLL" at base 7ffc226f0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "RPCRT4.DLL" at base 7ffc227e0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "KERNEL32.DLL" at base 7ffc23100000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffbe0670000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "OLE32.DLL" at base 7ffc21ef0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffc22090000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffbf6050000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffbdfa50000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffbf5830000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffbde960000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffbdded0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffbf56f0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffbdd620000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "NTDLL.DLL" at base 7ffc23a90000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "SHELL32.DLL" at base 2362f4c0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "BCRYPT.DLL" at base 7ffc20790000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc1fe70000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "COMBASE.DLL" at base 7ffc22090000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffc22090000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "SSPICLI.DLL" at base 7ffc20150000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffbf51f0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffc074e0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffc13460000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffc14180000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffc13a30000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffc13aa0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "AMSI.DLL" at base 7ffc13240000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffc16f10000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffc131c0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\K3ER2DFZ.DLL" at base 7ffc03f70000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "OLEAUT32.DLL" at base 7ffc237e0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc212a0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "ADVAPI32" at base 7ffc23730000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRCOMPRESSION.DLL" at base 7ffc07360000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "WLDP.DLL" at base 7ffc206a0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffc17150000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffc23100000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffc23730000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WEBENGINE4.DLL" at base 7ffbf5fa0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WEBENGINE4.DLL" at base 7ffbf5fa0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "WEBENGINE4.DLL" at base 7ffbf5fa0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.SECURITY\V4.0_4.0.0.0__B03F5F7F11D50A3A\CRYPT32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "CRYPT32.DLL" at base 7ffc21070000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNTEB92AA12#\00D77E4F6209222F01FBA5B5EE335B0E\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 7ffbf3570000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffbf0aa0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffbf2ab0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "C:\MSVCRT.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "MSVCRT.DLL" at base 7ffc238c0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "KERNELBASE" at base 7ffc21320000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "IPHLPAPI.DLL" at base 7ffc1f9e0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "WS2_32.DLL" at base 7ffc231d0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc20370000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffc03e90000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffc03e70000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffc03e50000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffc080e0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffc02900000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc181d0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc19740000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\CBB406CB22D15D17F35C72A00F7B903C\SYSTEM.NET.HTTP.NI.DLL" at base 7ffbf4fb0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "RASAPI32.DLL" at base 7ffbf4ea0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "RASMAN.DLL" at base 7ffc01b10000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "WINHTTP.DLL" at base 7ffc1aa10000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffc028d0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "SECUR32.DLL" at base 7ffc155f0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffc1fd70000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffc0e890000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc1e4e0000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "IMM32.DLL" at base 7ffc23520000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "COMCTL32.DLL" at base 7ffc0bb80000 "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" loaded module "GDI32.DLL" at base 7ffc21890000 "cmd.exe" loaded module "KERNEL32" at base 7ffc23100000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc21320000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc21320000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc21320000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc23520000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc21320000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc21320000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc21320000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbf74c0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffc23100000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffc23a90000 "cmd.exe" loaded module "KERNELBASE" at base 7ffc21320000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffc1ff00000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc23520000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc21320000 "netsh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc21320000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc21320000 "netsh.exe" loaded module "KERNEL32" at base 7ffc23100000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbf74c0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffc1ff00000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffc196c0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7ffc227e0000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffbf4fd0000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7ffc238c0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ffbf7460000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffbf2a40000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffc0e390000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffc03e50000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffbfbf00000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffc0cf80000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ffbf6e60000 "netsh.exe" loaded module "NETPROFM.DLL" at base 7ffc1c500000 "netsh.exe" loaded module "NETSH.EXE" at base 7ff641390000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7ffbf2080000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffbf9230000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ffbf2020000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7ffbf1f00000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffbf0a60000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffc0c790000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffbf3550000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffc0c670000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffbf09d0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffc0c1d0000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffbf09a0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffbf0930000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffc22090000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc1e4e0000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7ffc19140000 "netsh.exe" loaded module "USERENV.DLL" at base 7ffc20470000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7ffc055f0000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7ffc23100000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc212a0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ffbf1ee0000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7ffc237e00003e:T544,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")3f:T4c1,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"40:T42e,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "netsh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "netsh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")41:T103a,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001548-00000C2B-3458092510] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001548-00000C2B-3458803937] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001548-00000C2B-3458996941] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001548-00000C2B-3459132166] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00001548-00000C2B-3459523491] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001548-00000C2B-3459592499] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001548-00000C2B-3459668901] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00001548-00000C2B-3459994679] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00001548-00000C2B-3460127029] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll" [Source: 00000000-00001548-00000C2B-3460191282] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll" [Source: 00000000-00001548-00000C2B-3460243027] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00001548-00000C2B-3460340876] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00001548-00000C2B-3460397958] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00001548-00000C2B-3460551815] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001548-00000C2B-3461042091] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001548-00000C2B-3461564186] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001548-00000C2B-3461793459] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001548-00000C2B-3461898838] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001548-00000C2B-3462071267] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001548-00000C2B-3462293270] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll" [Source: 00000000-00001548-00000C2B-3462524298] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00001548-00000C2B-3462579578] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001548-00000C2B-3463065377] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001548-00000C2B-3463465560] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001548-00000C2B-3465938581]42:T999,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\INTERNATIONAL\CALENDARS\TWODIGITYEARMAX"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\INTERNATIONAL\CALENDARS\TWODIGITYEARMAX"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.MANAGEMENT__B03F5F7F11D50A3A"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.MANAGEMENT__B03F5F7F11D50A3A"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CONFIGURATION.INSTALL__B03F5F7F11D50A3A"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CONFIGURATION.INSTALL__B03F5F7F11D50A3A"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.10.0.MICROSOFT.JSCRIPT__B03F5F7F11D50A3A"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.10.0.MICROSOFT.JSCRIPT__B03F5F7F11D50A3A"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32"; Key: ""; Value: "")43:T87e,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: "ISHVSICONTAINER"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "WMIDISABLECOMSECURITY"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ALWAYSREADHKCRFORCLSIDS"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}"; Key: ""; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}"; Key: "APPID"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING DIRECTORY"; Value: "")44:T629,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll.aux" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\ce0fd4f5b50baa17e7b80e4ee874ad11\system.ni.dll.aux" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\bee998043eb1e9badecd282a79540a5e\system.windows.forms.ni.dll.aux" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\3c82a5286b5172d5a68c8df2e09c4c40\system.drawing.ni.dll.aux" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\2a25b59872a72da9b55f952ab1b0bc8b\system.configuration.ni.dll.aux" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\990501e6199819806f01c8ecac88baac\system.core.ni.dll.aux" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\f0078c8c05b31633e5966c5629e65602\system.xml.ni.dll.aux"45:T794,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\imm32.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\CRYPTSP.DLL" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to touch file "C:\Windows\System32\cryptsp.dll"46:Te6c,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\profapi.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\SspiCli.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Newtonsoft.Json.dll" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Newtonsoft.Json.exe" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll"47:Tb9f,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe.config" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\stub" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.INI" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.28b9ef5a#" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.INI" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.INI" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.INI" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.INI" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dynamic" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.INI" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics"48:T4bf,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" writes file "c:\users\%osuser%\appdata\local\temp\ddf3421a5e3723733fd0603fdadee0fa\chromium_cookies_57ghehkvm4wr9pq_2026-02-16_21.00.32.json" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" writes file "c:\users\%osuser%\appdata\local\temp\ddf3421a5e3723733fd0603fdadee0fa\gecko_cookies_57ghehkvm4wr9pq_2026-02-16_21.03.24.json" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" writes file "c:\users\%osuser%\appdata\local\temp\ddf3421a5e3723733fd0603fdadee0fa\filezilla_57ghehkvm4wr9pq_2026-02-16_21.03.24.txt" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" writes file "%temp%\ddf3421a5e3723733fd0603fdadee0fa\chromium_cookies_57ghehkvm4wr9pq_2026-02-16_21.00.32.json" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" writes file "%temp%\ddf3421a5e3723733fd0603fdadee0fa\gecko_cookies_57ghehkvm4wr9pq_2026-02-16_21.03.24.json" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" writes file "%temp%\ddf3421a5e3723733fd0603fdadee0fa\filezilla_57ghehkvm4wr9pq_2026-02-16_21.03.24.txt" "netsh.exe" writes file "\device\namedpipe"49:T9d3,Observed Namespace "System.Net.Mail.MailMessage" and MemberReference ".ctor" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_To" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.MailAddressCollection" and MemberReference "Add" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.MailAddress" and MemberReference ".ctor" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_From" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Subject" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Body" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.Attachment" and MemberReference ".ctor" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_Attachments" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference ".ctor" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_UseDefaultCredentials" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Credentials" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Port" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_EnableSsl" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_DeliveryMethod" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "SendMailAsync" in "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe"4a:Td5a,Found string "5__1" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpDeliveryMethod" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpPassword" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "UploadToSmtp" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpSender" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpReceiver" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpServer" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "_smtpserver" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpSendLogs" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpClient" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpPort" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "_smtpport" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SmtpCheckBox" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "(Stub.SmtpSendLogs+d__7" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "'Stub.SmtpSendLogs+d__8" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "(Stub.UploadToSmtp+d__8" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SMTPServer" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SMTPPort" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Program: Checking Smtp configuration..." (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Program: Invalid Smtp configuration, initiating self-destruct" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Program: Smtp configuration is valid" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Program: Error checking Smtp configuration:" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Sending logs to Smtp" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Logs Sent to Smtp" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Config: Begin Decrypting Smtp details" (Indicator: "smtp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe")4b:Te89,"4.0.0.0" "11.0.0.0" "1.0.0.0" "10.200.169.204" "104.198.155.173" "104.200.151.35" "109.145.173.169" "109.226.37.172" "109.74.154.90" "109.74.154.91" "109.74.154.92" "140.228.21.36" "149.88.111.79" "154.61.71.50" "154.61.71.51" "172.105.89.202" "174.7.32.199" "176.63.4.179" "178.239.165.70" "181.214.153.11" "185.220.101.107" "185.44.176.125" "185.44.176.135" "185.44.176.143" "185.44.176.70" "185.44.176.85" "185.44.177.132" "185.44.177.133" "185.44.177.138" "185.44.177.193" "185.44.177.254" "185.44.177.55" "188.105.165.80" "188.105.71.44" "188.105.91.116" "188.105.91.143" "188.105.91.173" "191.101.209.39" "191.96.150.218" "192.211.110.74" "192.40.57.234" "192.87.28.103" "193.128.114.45" "193.225.193.201" "193.226.177.40" "194.110.13.70" "194.154.78.144" "194.154.78.152" "194.154.78.160" "194.154.78.169" "194.154.78.179" "194.154.78.210" "194.154.78.227" "194.154.78.230" "194.154.78.235" "194.154.78.77" "194.154.78.91" "194.186.142.178" "194.186.142.180" "194.186.142.183" "194.186.142.195" "194.186.142.204" "194.186.142.214" "194.186.142.236" "194.186.142.246" "195.181.175.103" "195.181.175.105" "195.228.105.39" "195.239.51.3" "195.239.51.42" "195.239.51.46" "195.239.51.59" "195.239.51.65" "195.239.51.73" "195.239.51.80" "195.239.51.89" "195.68.142.20" "195.68.142.3" "195.74.76.222" "2.94.86.134" "20.114.22.115" "20.99.160.173" "204.101.161.31" "204.101.161.32" "207.102.138.83" "207.102.138.93" "208.78.41.115" "209.127.189.74" "212.119.227.136" "212.119.227.151" "212.119.227.167" "212.119.227.179" "212.119.227.184" "212.41.6.23" "213.33.142.50" "213.33.190.109" "213.33.190.118" "213.33.190.171" "213.33.190.22" "213.33.190.227" "213.33.190.242" "213.33.190.35" "213.33.190.42" "213.33.190.46" "213.33.190.69" "213.33.190.74" "23.128.248.46" "34.105.0.27" "34.105.183.68" "34.105.72.241" "34.138.255.104" "34.138.96.23" "34.141.146.114" "34.141.245.25" "34.142.74.220" "34.145.195.58" "34.145.89.174" "34.17.49.70" "34.17.55.59" "34.253.248.228" "34.73.60.153" "34.83.46.130" "34.85.243.241" "34.85.253.170" "35.186.33.204" "35.192.93.107" "35.197.127.11" "35.199.6.13" "35.229.69.227" "35.237.47.12" "38.154.242.210" "45.8.148.171" "5.45.98.162" "52.250.30.131" "64.124.12.162" "67.218.111.202" "78.139.8.50" "79.104.209.109" "79.104.209.168" "79.104.209.172" "79.104.209.221" "79.104.209.231" "79.104.209.24" "79.104.209.249" "79.104.209.33" "79.104.209.36" "79.104.209.66" "80.211.0.97" "81.181.60.60" "84.147.54.113" "84.147.54.61" "84.147.56.249" "84.147.60.41" "84.147.60.52" "84.147.61.28" "84.147.62.12" "84.147.63.171" "84.147.63.236" "84.57.183.108" "84.57.200.69" "87.166.48.65" "87.166.50.1" "87.166.50.213" "87.166.51.209" "88.132.225.100" "88.132.226.203" "88.132.227.238" "88.132.231.71" "88.153.199.169" "88.64.35.141" "88.64.36.101" "88.66.107.75" "88.66.111.235" "88.66.8.175" "88.67.131.90" "88.67.134.91" "88.86.117.130" "89.208.29.106" "89.208.29.108" "89.208.29.140" "89.208.29.149" "89.208.29.63" "89.208.29.64" "89.208.29.95" "89.208.29.96" "89.208.29.97" "89.208.29.98" "92.211.109.160" "92.211.192.144" "92.211.52.62" "92.211.55.199" "93.216.75.209" "95.25.204.90" "95.25.71.112" "95.25.71.12" "95.25.71.5" "95.25.71.64" "95.25.71.65" "95.25.71.70" "95.25.71.80" "95.25.71.86" "95.25.71.87" "95.25.71.89" "95.25.71.92" "95.25.81.24" Potential IP "64.124.12.162" found in string "250-cp-in-12.webhostbox.net Hello DESKTOP-8LD9T6N [64.124.12.162]250-SIZE 52428800250-LIMITS MAILMAX=50 RCPTMAX=50000250-8BITMIME250-PIPELINING250-PIPECONNECT250-AUTH PLAIN LOGIN250 HELP"4c:Tc61,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\stub\* (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindNextFileW" with parameter bee998043eb1e9badecd282a79540a5e (UID: 00000000-00001548) "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00001548)4d:Ta59,Found string "aeS)g" (Indicator: "aes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "5__2" (Indicator: "zipfile"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "5__2" (Indicator: "base64"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "DecryptBase64" (Indicator: "base64"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "AesManaged" (Indicator: "aes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "FromBase64String" (Indicator: "base64"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "zipFilePath" (Indicator: "zipfile"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "CryptoStream" (Indicator: "cryptostream"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "AesGcm" (Indicator: "aes"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[-] Invalid Base64 format" (Indicator: "base64"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "base64" (Indicator: "base64"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe")4e:T778,Found reference to API "GetModuleHandle64" (Indicator: "GetModuleHandle"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "4742625092,4448,3121,,CreateToolhelp32Snapshot,kernel32.dll,"01:16:25.937",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp")4f:T617,Found string "_password" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Mailpassword" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "password_hex" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "password_value" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Chromium_passwords_" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "password" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "password-check" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Gecko_passwords_" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Wifi - GetPassword: Failed to retrieve password for profile '" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "- Saved networks with passwords:" (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "No WinSCP sessions found or master password is enabled." (Indicator: "password"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe")50:Tb3d,Found string "[TAB]" (Indicator: "[tab]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[BACKSPACE]" (Indicator: "[BACKSPACE]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[ESC]" (Indicator: "[esc]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[PAGEUP]" (Indicator: "[PageUp]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[PAGEDOWN]" (Indicator: "[Pagedown]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[END]" (Indicator: "[end]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[HOME]" (Indicator: "[home]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[LEFT]" (Indicator: "[left]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[RIGHT]" (Indicator: "[right]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[DOWN]" (Indicator: "[down]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[PRINTSCREEN]" (Indicator: "[PrintScreen]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[INSERT]" (Indicator: "[insert]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[DELETE]" (Indicator: "[Delete]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[SCROLLLOCK]" (Indicator: "[ScrollLock]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[NUMLOCK]" (Indicator: "[NumLock]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[F10]" (Indicator: "[F10]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[F11]" (Indicator: "[F11]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[F12]" (Indicator: "[F12]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[SHIFT]" (Indicator: "[shift]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[CTRL]" (Indicator: "[ctrl]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[CTRL]" (Indicator: "[Ctrl]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[ALT]" (Indicator: "[alt]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "[ALT]" (Indicator: "[Alt]"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe")51:T57f,Found string "SystemInfo >> GetPublicIP : Request error" (Indicator: "systeminfo"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "hostname" (Indicator: "hostname"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "chcp 65001" (Indicator: "chcp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SystemInfo >> GetPublicIP : Request error\n" (Indicator: "systeminfo"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "chcp 65001 && netsh wlan show profile | findstr All" (Indicator: "chcp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "chcp 65001 && netsh wlan show profile name=\"" (Indicator: "chcp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe"), Found string "chcp 65001 && netsh wlan show networks mode=bssid" (Indicator: "chcp"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe"), Found string "HostName" (Indicator: "hostname"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe"), Found string "/C chcp 65001 && netsh wlan show networks mode=bssid" (Indicator: "chcp"; File: "cmd.exe"), Found string "/C chcp 65001 && netsh wlan show profile | findstr All" (Indicator: "chcp"; File: "cmd.exe")52:T465,Found string "SELECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Select * from AntivirusProduct" (Indicator: "antivirusproduct"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp")53:T94e,Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00001548-00000BC1-3483890753") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00004332-00000BC0-3484026676") Found string "\Device\HarddiskVolume3\Windows\System32\chcp.com" (Indicator: "\Device\"; Source: "00000000-00004332-00000BC0-3485145647") Found string "\Device\HarddiskVolume3\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00004332-00000BC0-3485172650") Found string "\Device\HarddiskVolume3\Windows\System32\findstr.exe" (Indicator: "\Device\"; Source: "00000000-00005304-00000BC0-3491783887") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003964.00000000.293682.6ECE0000.00000004.mdmp, 00000000-00003964.00000000.293682.6EF10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003964.00000000.293682.6ECE0000.00000004.mdmp, 00000000-00003964.00000000.293682.6EF10000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003964.00000000.293682.6ECE0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00003964.00000000.293682.6ECE0000.00000004.mdmp") Found string "Device\HarddiskVolume3\DosDevices\C:\??\Volume{44294f7c-6083-41c6-8176-3c202d755616}" (Indicator: "\DosDevices\"; Source: "00000000-00003964.00000000.293682.6ED43000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004128.00000000.293262.0C960000.00000004.mdmp, 00000000-00004128.00000000.293262.0CAC0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004128.00000000.293262.0C960000.00000004.mdmp, 00000000-00004128.00000000.293262.0CAC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004128.00000000.293262.0C960000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00004128.00000000.293262.0C960000.00000004.mdmp")54:T57e,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00004128.00000000.293262.4139C000.00000002.mdmp")55:T463,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "ITZPLZGETVKK9DSIJF9RPYNUDWKDCAXQQAWIPOCBFKXZZHZBXK8JTNQ1SUZCJNECD0FZ6TYDAOEKIUV5CMM9WTTNYZCKLWLV7ZU2TIFDLKQEGLLYTAQIPE"; Value: "0C06000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "23D8D023CB9FDC010000000000000000000000000200000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "95DCD45ECB9FDC010000000000000000000000000200000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS")56:Tcc6,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\PERFORMANCE"; Key: "LIBRARY"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "VALIDATERESPONSENAMES"; Value: "")57:Te58,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "ITZPLZGETVKK9DSIJF9RPYNUDWKDCAXQQAWIPOCBFKXZZHZBXK8JTNQ1SUZCJNECD0FZ6TYDAOEKIUV5CMM9WTTNYZCKLWLV7ZU2TIFDLKQEGLLYTAQIPE"; Value: "0C06000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "23D8D023CB9FDC010000000000000000000000000200000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "95DCD45ECB9FDC010000000000000000000000000200000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")58:Te8d,Found string "CreateFileMappingA" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNEL32.DLL) Found string "CredReadW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: SECHOST.DLL) Found string "OpenServiceW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: SECHOST.DLL) Found string "GetModuleHandleW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "GetFinalPathNameByHandleW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "QueryFullProcessImageNameW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "ChangeServiceConfigW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: SECHOST.DLL) Found string "CreateProcessWithTokenW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: ADVAPI32.DLL) Found string "CreateDesktopW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: USER32.DLL) Found string "OpenDesktopW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: USER32.DLL) Found string "OpenSCManagerW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: SECHOST.DLL) Found string "CreateProcessW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryW" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "GetClipboardData" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: USER32.DLL) Found string "SetClipboardData" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: USER32.DLL) Found string "GlobalAlloc" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualAlloc" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadId" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "GetCurrentThreadId" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "GetCurrentProcessId" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "NtSuspendThread" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: NTDLL.DLL) Found string "GetExitCodeThread" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "NtResumeThread" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: NTDLL.DLL) Found string "CreateThread" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL) Found string "CreateRemoteThread" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, API is part of module: KERNELBASE.DLL)59:T6ef,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\Chromium_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.00.32.json" with delete access "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\Chromium_credit_cards_57GhEHkvM4wR9PQ_2026-02-16_21.00.32.txt" with delete access "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\Chromium_passwords_57GhEHkvM4wR9PQ_2026-02-16_21.00.32.txt" with delete access "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\FileZilla_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.txt" with delete access "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\Gecko_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.json" with delete access "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\Gecko_credit_cards_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.txt" with delete access "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\Gecko_passwords_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.txt" with delete access "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ddf3421a5e3723733fd0603fdadee0fa\SavedNetworks.txt" with delete access5a:T1f43,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP EMAIL ADDRESS") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP SERVER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 SERVER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER NAME") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER NAME") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP EMAIL ADDRESS") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP USER NAME") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP SERVER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP SERVER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER NAME") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "EMAIL") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP USER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP SERVER URL") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL USER NAME") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL SERVER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD2") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD2") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD2") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD2") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD2") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP EMAIL ADDRESS") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP SERVER") "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 SERVER")5b:Tcec,"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" "904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite"5c:T527,"> GetPublicIP : Request error\" (Indicator: \"systeminfo \"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found string \"SystemInfo >> GetPublicIP : Request error\\n\" (Indicator: \"systeminfo \"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at ed661d102769ec0e8013d9f9d807843c-6000216-SharpInjector~GetProcessHandleWithRequiredRights\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at ed661d102769ec0e8013d9f9d807843c-6000217-SharpInjector~IsProcess64Bit\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at ed661d102769ec0e8013d9f9d807843c-60002c6-Utils~IsProcessAdmin\n Stub.NativeMethods::OpenProcessToken(System.IntPtr,System.UInt32,System.IntPtr&) at ed661d102769ec0e8013d9f9d807843c-60002c7-Utils~IsProcessAdmin\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at ed661d102769ec0e8013d9f9d807843c-60002cc-Utils~DupHandle\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at ed661d102769ec0e8013d9f9d807843c-60002cf-Utils~KillProcess","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" issued a query \"SELECT * FROM win32_operatingsystem\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" issued a query \"Select * from AntivirusProduct\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$32","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00004128-00000C17-3487808010\n \"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00003964-00000C17-3493797272","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"VirtualAlloc\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed API \"VirtualAllocEx\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed API \"LoadLibraryW\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed API \"GetProcAddress\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed API \"OpenProcessToken\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"22FF89586561FC2D52F77491E9F1EFF1B80BE33E\")\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"22FF89586561FC2D52F77491E9F1EFF1B80BE33E\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\ddf3421a5e3723733fd0603fdadee0fa (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /C chcp 65001 && netsh wlan show networks mode=bssid\" - (UID: 00000000-00001548)\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All\" - (UID: 00000000-00001548)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"chcp 65001\" - (UID: 00000000-00004332)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"netsh wlan show networks mode=bssid\" - (UID: 00000000-00004332)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"chcp 65001\" - (UID: 00000000-00005304)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"netsh wlan show profile\" - (UID: 00000000-00005304)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"findstr All\" - (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\iTzpLZGEtVkk9Dsijf9rpyNUDwKDCAxQqaWIPoCbFKXzzHZBxk8jtnq1sUzCjNECd0FZ6TYdAoEKiUV5cmm9wtTNyZCKLWlv7zU2TIFdlkqeGLlYtaqipe\" - (UID: 00000000-00001548)\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001548)\n \"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005304)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"icanhazip.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.16.184.241:80\"\n \"103.211.216.130:587\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$36","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM win32_operatingsystem\" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, Indicator: \"select * from win32_operatingsystem\")\n \"Select * from AntivirusProduct\" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM Win32_Processor\" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, Indicator: \"select * from win32_processor\")\n \"Select * From Win32_ComputerSystem\" (Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe, Indicator: \"select * from win32_computersystem\")\n \"SELECT * FROM Win32_VideoController\" (Source: 600001d-AntiAnalysis~SuspiciousGPU, Indicator: \"select * from win32_videocontroller\")\n \"select * from Win32_OperatingSystem\" (Source: 00000000-00004128.00000000.293262.4139C000.00000002.mdmp, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"NtSuspendThread\" (Indicator: \"SuspendThread\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"NtResumeThread\" (Indicator: \"ResumeThread\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"[-] CreateThread failed\" (Indicator: \"CreateThread\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$38","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindowFlags\" (Indicator: \"ShowWindow\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.set_StartInfo\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed function \"Process.Start\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" with parameter %TEMP%\\ddf3421a5e3723733fd0603fdadee0fa (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3a","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"az@polywin.co.in\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$3c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"twitter\" (Indicator: \"twitter\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found string \"paypal\" (Indicator: \"paypal\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\iTzpLZGEtVkk9Dsijf9rpyNUDwKDCAxQqaWIPoCbFKXzzHZBxk8jtnq1sUzCjNECd0FZ6TYdAoEKiUV5cmm9wtTNyZCKLWlv7zU2TIFdlkqeGLlYtaqipe","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"-1-5-21-1271187874-1938232448-3812392235-1001\\Software\\Microsoft\" in Source: 00000000-00003964.00000000.293682.6ED43000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\NetSh\" in Source: 00000000-00004128.00000000.293262.4139C000.00000002.mdmp\n \"System\\CurrentControlSet\\Services\\RemoteAccess\\Parameters\" in Source: 00000000-00004128.00000000.293262.4139C000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Mon\n 16 Feb 2026 20:59:48 GMT\nContent-Type: text/plain\nContent-Length: 14\nConnection: keep-alive\nCF-RAY: 9ceff88bea7fcc90-SJC\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET\nSet-Cookie: __cf_bm=iDKAg6J_c_Mo5Lh6BSwfaxFKlqPIBioY6aU9sM60l9U-1771275588-1.0.1.1-IB584xb8BptesdUMQugxz4mgS.F6tvvlQcSlOU3Q3HCFpXF5vqz6WUDzhnkb2bT5RvQq2UkU3.55N0p8C0uW54x.igiSCSrORUEHKZ99aZY; path=/; expires=Mon\n 16-Feb-26 21:29:48 GMT; domain=.icanhazip.com; HttpOnly\nServer: cloudflare\nalt-svc: h3=\":443\"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 0CCB0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 6F020000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at E0670000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 13240000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 212A0000\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 20790000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 20790000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 212A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E1C30000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 227E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 227E0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 227E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020425921fc7f0000@ntdll.dll\"\n \"220023000000000040425921fc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" was detected as \".NET\" and name: \"Library\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"GetAntivirus\" (Indicator: \"antivirus\") in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\n \"Antivirus:\" (Indicator: \"antivirus\") in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\n \"Comodo\" (Indicator: \"comodo\") in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\n \"\\n🛡️ Antivirus:\" (Indicator: \"antivirus\") in Source: 60000d4-DiscordSendLogsSendMessageInfoAsyncd__3~MoveNext\n \"\\nAntivirus:\" (Indicator: \"antivirus\") in Source: 6000100-Filemanager~CreateArchive","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00001548-00000BC1-3483890753]\n Observed system executable string:\"%WINDIR%\\system32\\netsh.exe\" [Source: 00000000-00004332-00000C47-2639423940]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00004332-00000BC0-3484026676]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\netsh.exe\" [Source: 00000000-00004332-00000BC0-3485172650]\n Observed system executable string:\"%WINDIR%\\system32\\findstr.exe\" [Source: 00000000-00005304-00000C47-2741014170]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\findstr.exe\" [Source: 00000000-00005304-00000BC0-3491783887]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00004332) was launched with new environment variables: \"USERDNSDOMAIN=\"57GhEHkvM4wR9PQ\"\"\n Process \"cmd.exe\" (UID: 00000000-00004332) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"chcp.com\" (UID: 00000000-00004440) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00005304) was launched with missing environment variables: \"PROMPT\"\n Process \"chcp.com\" (UID: 00000000-00007704) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"icanhazip.com\"\n \"mail.polywin.co.in\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$40","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00003964.00000000.293682.6ECE0000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00004128.00000000.293262.0C960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show networks mode=bssid\" (UID: 00000000-00004332)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00004440)\n Spawned process \"netsh.exe\" with commandline \"netsh wlan show networks mode=bssid\" (UID: 00000000-00004128)\n Spawned process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show profile | findstr All\" (UID: 00000000-00005304)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00007704)\n Spawned process \"netsh.exe\" with commandline \"netsh wlan show profile\" (UID: 00000000-00003964)\n Spawned process \"findstr.exe\" with commandline \"findstr All\" (UID: 00000000-00006616)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show networks mode=bssid\" (UID: 00000000-00004332)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00004440)\n Spawned process \"netsh.exe\" with commandline \"netsh wlan show networks mode=bssid\" (UID: 00000000-00004128)\n Spawned process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show profile | findstr All\" (UID: 00000000-00005304)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00007704)\n Spawned process \"netsh.exe\" with commandline \"netsh wlan show profile\" (UID: 00000000-00003964)\n Spawned process \"findstr.exe\" with commandline \"findstr All\" (UID: 00000000-00006616)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=R13, O=Let's Encrypt, C=US\" (SHA1: 9E:41:05:AB:74:46:2F:38:5B:0A:B8:10:CE:7F:68:5D:B2:92:F2:E1; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ddf3421a5e3723733fd0603fdadee0fa\\Chromium_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.00.32.json\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ddf3421a5e3723733fd0603fdadee0fa\\Gecko_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.json\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ddf3421a5e3723733fd0603fdadee0fa\\FileZilla_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.txt\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary64\" (Indicator: \"LoadLibrary\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"netsh.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Chromium_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.00.32.json\" has type \"JSON text data\"- Location: [%TEMP%\\ddf3421a5e3723733fd0603fdadee0fa\\Chromium_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.00.32.json]- [targetUID: 00000000-00001548]\n \"Gecko_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.json\" has type \"JSON text data\"- Location: [%TEMP%\\ddf3421a5e3723733fd0603fdadee0fa\\Gecko_cookies_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.json]- [targetUID: 00000000-00001548]\n \"FileZilla_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\ddf3421a5e3723733fd0603fdadee0fa\\FileZilla_57GhEHkvM4wR9PQ_2026-02-16_21.03.24.txt]- [targetUID: 00000000-00001548]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" queries basic process information of the \"C:\\904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (UID: 1548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$48","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001548-00000C2C-3500105491\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001548-00000C2C-3500083438\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001548-00000C2C-3501031782\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001548-00000C2C-3501031843\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00001548-00000C2C-3501128712\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00001548-00000C2C-3501131846\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform email related activity (Dotnet)","description":"$49","origin":"Static Parser","mitre_attack_id":"T1071.003","relevance":1,"id":"static-160","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed namespace \"System.Net.Http\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed namespace \"System.Net.Http.Headers\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"\n Observed namespace \"System.Net.Security\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to \"_smtpserver\" (Indicator: \"SmtpServer\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to \"SMTPServer\" (Indicator: \"SmtpServer\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to \"SmtpServer Decrypted: '\" (Indicator: \"SmtpServer\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStreamAsync\" (Indicator: \"GetRequestStream\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetRequestStreamAsync\" (Indicator: \"GetRequestStreamAsync\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"GetHostName\" (Indicator: \"gethostname\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00001548-00000C2C-3500083438\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00001548-00000C2C-3500113306\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh wlan show networks mode=bssid\" (UID: 00000000-00004128)\n Process \"netsh.exe\" with commandline \"netsh wlan show profile\" (UID: 00000000-00003964)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Dotnet code contains ability to perform FTP request","description":"Observed TypeReference \"FtpWebResponse\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.002","relevance":1,"id":"static-149","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://t.me/oldphantomoftheopera\"\n Heuristic match: \"icanhazip.com\"\n Heuristic match: \"mail.polywin.co.in\"\n Pattern match: \"https://discord.com/api/v9/users/@me\"\n Pattern match: \"https://www.phantomsoftwares.site/logo/phantom_discord.png\"\n Pattern match: \"https://t.me/oldphantomoftheopera\\n\\n\"\n Heuristic match: \"chrome_xmr.pt\"\n Heuristic match: \"az@polywin.co.in\"\n Pattern match: \"http://icanhazip\"\n Pattern match: \"james.newtonking.com/projects/json\"\n Heuristic match: \"json.net\"\n Heuristic match: \"%windir%\\system32\\chcp.com\"\n Heuristic match: \"\\device\\harddiskvolume3\\windows\\system32\\chcp.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://t.me\"\n Found HTTPS url \"https://www.phantomsoftwares.site\"\n Found HTTPS url \"https://discord.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"mail.polywin.co.in\" (9 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"mail.polywin.co.in\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"\\\" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\\\"\" (Indicator: \"--user-data-dir\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netsh.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"GetComputerNameW\" (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"GetUserNameW\" (UID: 00000000-00001548)\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"2362fe6b2b0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00003964.00000000.293682.6ED2B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"get_ProcessName\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle64\" (Indicator: \"GetModuleHandle\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetModuleHandle failed\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress64\" (Indicator: \"GetProcAddress\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetEnvironmentVariables\" (Indicator: \"GetEnvironmentVariable\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at ed661d102769ec0e8013d9f9d807843c-60002c5-Utils~IsAdmin","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"chcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found string \"\\\" key=clear | findstr Key\" (Indicator: \"findstr \"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"), Found string \"\"cmd.exe\" /C chcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; Source: \"00000000-00001548-00000C47-81856755646\"), Found string \"findstr All\" (Indicator: \"findstr \"; Source: \"00000000-00005304-00000C47-2741014170\"), Found string \"/C chcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\n \"\\Thunderbird\\Profiles\" in Source: 904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\n \"Software\\\\Microsoft\\\\Office\\\\15.0\\\\Outlook\\\\Profiles\\\\Outlook\\\\9375CFF0413111d3B88A00104B2A6676\" in Source: 60001dc-Outlook~GrabOutlook\n \"Software\\\\Microsoft\\\\Office\\\\16.0\\\\Outlook\\\\Profiles\\\\Outlook\\\\9375CFF0413111d3B88A00104B2A6676\" in Source: 60001dc-Outlook~GrabOutlook\n \"Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows Messaging Subsystem\\\\Profiles\\\\Outlook\\\\9375CFF0413111d3B88A00104B2A6676\" in Source: 60001dc-Outlook~GrabOutlook\n \"\\\\Thunderbird\\\\Profiles\" in Source: 60001e9-cctor","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$50","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key3.db\" (Indicator: \"key3.db\"; in File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found string \"key4.db\" (Indicator: \"key4.db\"; in File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$52","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr All\" (UID: 00000000-00006616)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001548-00000C2C-3460600067\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001548-00000C2C-3461563320\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001548)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003964.00000000.293682.6ED43000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001548-00000C2C-3501206734","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$55","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"Device\\HarddiskVolume3\\DosDevices\\C:\\??\\Volume{44294f7c-6083-41c6-8176-3c202d755616}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00003964.00000000.293682.6ED43000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"Couldnt set the shellcode memory as PAGE_EXECUTE_READWRITE!\" (Indicator: \"shellcode\"; File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" has section name .text with entropy \"7.467523082074338\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.16.184.241 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to create/switch the desktop","description":"Stub.NativeMethods::CreateDesktopW(System.String,System.String,System.IntPtr,System.UInt32,Stub.InternalStructs/DESKTOP_ACCESS,System.IntPtr) at ed661d102769ec0e8013d9f9d807843c-6000040-BrowserCrypto~GetAppBoundKey","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\")\n Found string \"\\\\%s\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004128.00000000.293262.4139C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$59","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"mail.polywin.co.in\" is probably a mail server","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" claims program is from Wed Sep 27 23:58:58 2051","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"0000000000\")\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"0000000000\")\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF00\")\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF00\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"polywin.co.in\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"icanhazip.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"Mail traffic to 103.211.216.130 on port 587 (SMTP)","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Detected network related fingerprinting/snooping attempt","description":"Process \"netsh.exe\" with commandline \"netsh wlan show networks mode=bssid\" (UID: 00000000-00004128)","origin":"Monitored Target","mitre_attack_id":"T1016","relevance":10,"id":"target-48","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$5b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" issued a query \"Select * from AntivirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"904a3d70be9fccbd1d04cdc90d20e430351f16696d3ba2e14400f31f2437c133.exe\" (UID: 00000000-00001548)\n Spawned process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show networks mode=bssid\" (UID: 00000000-00004332)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00004440)\n Spawned process \"netsh.exe\" with commandline \"netsh wlan show networks mode=bssid\" (UID: 00000000-00004128)\n Spawned process \"cmd.exe\" with commandline \"/C chcp 65001 && netsh wlan show profile | findstr All\" (UID: 00000000-00005304)\n Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00007704)\n Spawned process \"netsh.exe\" with commandline \"netsh wlan show profile\" (UID: 00000000-00003964)\n Spawned process \"findstr.exe\" with commandline \"findstr All\" (UID: 00000000-00006616)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"699384e942f6f467db05b979"},{"report_type":"sandbox","report_id":"699371c3f4e03e21190fdb01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"