26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Guloader Sample 936aa1ea53a8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 936aa1ea53a8…. Malware family: Trojan.Guloader. Threat score 100/100. 4/28 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467","keywords":["Malicious","Trojan.Guloader","malware analysis","sandbox report","threat intelligence","936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467"],"about":{"@type":"SoftwareApplication","name":"Scientize.exe","applicationCategory":["peexe","executable"],"identifier":"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Guloader","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c2,Observed string: "EPXEu~YPEEEPPP~P[Z^XYQMEE2E2t2|2222222222345J5Q55555555" (Indicator: "FreeLibrary") in Source: nsf4E58.tmp Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp28:T691,Observed string: "EPXEu~YPEEEPPP~P[Z^XYQMEE2E2t2|2222222222345J5Q55555555" (Indicator: "VirtualAlloc") in Source: nsf4E58.tmp Observed string: "EPXEu~YPEEEPPP~P[Z^XYQMEE2E2t2|2222222222345J5Q55555555" (Indicator: "VirtualFree") in Source: nsf4E58.tmp29:Ta23,"Scientize.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006272) "Scientize.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000560016e1ba7528ed560020ed56002ced56000200000080f6677738ed5600aaecba750200000000000000e447fc71b6ecba754131174f70ed56007de0ba7564e0ba750931174fe447fc7105000000f09dfc710000000075e2fc7186e2fc71f0ed5600802bbd75199a863afeffffff7ced5600e0dfba752002fe718ced560049d9fd71c06400722002fe7198ed560063d9fd712002fe71bced5600fa9dfc71010000000100000037068277010000000b2ebb7506000000dad8fd7100ee5600eecffd71c4dcfd71e2cffd71db357117010000000100000000000000503e061018000000fced560032ba8477a068007200000000000000000000000010ee5600 (UID: 00000000-00006272) "Scientize.exe" called "RtlGetVersion" (UID: 00000000-00006272) "Scientize.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004e00cd026600cd02 (UID: 00000000-00006272) "Scientize.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004e00cd026400cd02 (UID: 00000000-00006272)2a:T44d,"Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00006272) "Scientize.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00006272)2b:T4c7,Observed string: "EPXEu~YPEEEPPP~P[Z^XYQMEE2E2t2|2222222222345J5Q55555555" (Indicator: "GetLastError") in Source: nsf4E58.tmp Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp2c:Td675,Found string "5\Justifiable\Retsforflgelsens.iniuser32::SetWindowLongA(i 39,i ,i )$$\Spigeret\Gasflaskernes.dllDllUnregisterServer"-\Coveting\Vvene\Endeballes.Tur".\Saltkars\Prestricken.NskSoftware\Boomtowns\Odious\refrnsangenRedying%Skovlenes%\Satchel79.TorError! Can't initialize plug-ins directory. Please try again later.Zarrigerne SetupSpace required: Can't write: Could not find symbol: Could not load: Create folder: Create shortcut: Delete file: Delete on reboot: Error creating shortcut: Error decompressing data! Corrupted installer?ExecShell: Execute: Extract: Extract: error writing to file No OLE for: Output folder: Skipped: Copy Details To ClipboardB K M GAngiohemophiliaError opening file for writing:" (Indicator: "SetWindowLongA"; in File: "nsf4E58.tmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "BeginPaint" (Indicator: "BeginPaint"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CharNextA" (Indicator: "CharNextA"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CharNextW" (Indicator: "CharNextW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CloseClipboard" (Indicator: "CloseClipboard"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CopyFileW" (Indicator: "CopyFileW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CoTaskMemFree" (Indicator: "CoTaskMemFree"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CreateDirectoryW" (Indicator: "CreateDirectoryW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CreateFileW" (Indicator: "CreateFileW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CreateFontIndirectW" (Indicator: "CreateFontIndirectW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CreatePopupMenu" (Indicator: "CreatePopupMenu"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CreateProcessW" (Indicator: "CreateProcessW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CreateThread" (Indicator: "CreateThread"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "CreateWindowExW" (Indicator: "CreateWindowExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "DefWindowProcW" (Indicator: "DefWindowProcW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "DeleteFileW" (Indicator: "DeleteFileW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "DeleteObject" (Indicator: "DeleteObject"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "DestroyWindow" (Indicator: "DestroyWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "DispatchMessageW" (Indicator: "DispatchMessageW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "EmptyClipboard" (Indicator: "EmptyClipboard"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "EnableMenuItem" (Indicator: "EnableMenuItem"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "EnableWindow" (Indicator: "EnableWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "EndPaint" (Indicator: "EndPaint"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "EPXEu~YPEEEPPP~P[Z^XYQMEE2E2t2|2222222222345J5Q55555555" (Indicator: "CLSIDFromString"; in File: "nsf4E58.tmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "ExitWindowsEx" (Indicator: "ExitWindowsEx"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStringsW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "FillRect" (Indicator: "FillRect"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "FindClose" (Indicator: "FindClose"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "FindNextFileW" (Indicator: "FindNextFileW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00006272-00000C1E-72043092") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetClientRect" (Indicator: "GetClientRect"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetDC" (Indicator: "GetDC"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetDeviceCaps" (Indicator: "GetDeviceCaps"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpaceW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetFileSize" (Indicator: "GetFileSize"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetFullPathNameW" (Indicator: "GetFullPathNameW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetLastError" (Indicator: "GetLastError"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetModuleFileNameW" (Indicator: "GetModuleFileNameW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetPrivateProfileStringW" (Indicator: "GetPrivateProfileStringW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetSysColor" (Indicator: "GetSysColor"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetSystemDirectoryW" (Indicator: "GetSystemDirectoryW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetSystemMenu" (Indicator: "GetSystemMenu"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetTempFileNameW" (Indicator: "GetTempFileNameW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetTempPathW" (Indicator: "GetTempPathW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetTickCount" (Indicator: "GetTickCount"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetVersion" (Indicator: "GetVersion"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetWindowLongW" (Indicator: "GetWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetWindowRect" (Indicator: "GetWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GetWindowsDirectoryW" (Indicator: "GetWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GlobalFree" (Indicator: "GlobalFree"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GlobalLock" (Indicator: "GlobalLock"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "InitiateShutdownW" (Indicator: "InitiateShutdown"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "InvalidateRect" (Indicator: "InvalidateRect"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "IsWindow" (Indicator: "IsWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "IsWindowEnabled" (Indicator: "IsWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "IsWindowVisible" (Indicator: "IsWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "LoadImageW" (Indicator: "LoadImageW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValueW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "lstrcatW" (Indicator: "lstrcatW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "lstrcmpiA" (Indicator: "lstrcmpiA"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "lstrcmpiW" (Indicator: "lstrcmpiW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "lstrcmpW" (Indicator: "lstrcmpW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "lstrcpyA" (Indicator: "lstrcpyA"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "lstrlenA" (Indicator: "lstrlenA"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "lstrlenW" (Indicator: "lstrlenW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "MoveFileExW" (Indicator: "MoveFile"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "MoveFileW" (Indicator: "MoveFile"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "MulDiv" (Indicator: "MulDiv"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "OleInitialize" (Indicator: "OleInitialize"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "OleUninitialize" (Indicator: "OleUninitialize"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "OpenClipboard" (Indicator: "OpenClipboard"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "PeekMessageW" (Indicator: "PeekMessageW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "PostQuitMessage" (Indicator: "PostQuitMessage"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "ReadFile" (Indicator: "ReadFile"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegDeleteKeyExW" (Indicator: "RegDeleteKeyExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegDeleteKeyW" (Indicator: "RegDeleteKeyW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegDeleteValueW" (Indicator: "RegDeleteValueW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegEnumKeyW" (Indicator: "RegEnumKeyW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegEnumValueW" (Indicator: "RegEnumValueW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegisterClassW" (Indicator: "RegisterClassW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RegSetValueExW" (Indicator: "RegSetValueExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "ReleaseDC" (Indicator: "ReleaseDC"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "RemoveDirectoryW" (Indicator: "RemoveDirectoryW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "ScreenToClient" (Indicator: "ScreenToClient"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SelectObject" (Indicator: "SelectObject"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetClipboardData" (Indicator: "SetClipboardData"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetCurrentDirectoryW" (Indicator: "etCurrentDirectoryW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetCursor" (Indicator: "SetCursor"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetDefaultDllDirectories" (Indicator: "SetDefaultDllDirectories"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetEnvironmentVariableW" (Indicator: "SetEnvironmentVariableW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetFileAttributesW" (Indicator: "SetFileAttributesW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetFileTime" (Indicator: "SetFileTime"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetForegroundWindow" (Indicator: "SetForegroundWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetTimer" (Indicator: "SetTimer"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetWindowPos" (Indicator: "SetWindowPos"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SetWindowTextW" (Indicator: "SetWindowTextW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SHBrowseForFolderW" (Indicator: "SHBrowseForFolderW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "ShellExecuteExW" (Indicator: "ShellExecuteExW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SHFileOperationW" (Indicator: "SHFileOperationW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SHGetFileInfoW" (Indicator: "GetFileInfo"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SHGetFolderPathW" (Indicator: "SHGetFolderPathW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SHGetPathFromIDListW" (Indicator: "SHGetPathFromIDListW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "ShowWindow" (Indicator: "ShowWindow"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "Sleep" (Indicator: "Sleep"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "SleepConditionVariableCS" (Indicator: "Sleep"; in Source: "00000000-00006272-00000C1E-72704377") Found string "SystemParametersInfoW" (Indicator: "SystemParametersInfoW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "TrackPopupMenu" (Indicator: "TrackPopupMenu"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable"; in Source: "00000000-00006272-00000C1E-72704503") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "WriteFile" (Indicator: "WriteFile"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "WritePrivateProfileStringW" (Indicator: "WritePrivateProfileStringW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "wsprintfA" (Indicator: "wsprintfA"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "wsprintfW" (Indicator: "wsprintfW"; in File: "936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin") Found string "MulDiv" (Indicator: "MulDiv"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "DeleteFileW" (Indicator: "DeleteFileW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "FindFirstFileW" (Indicator: "FindFirstFileW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "FindNextFileW" (Indicator: "FindNextFileW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "lstrlenA" (Indicator: "lstrlenA"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetPrivateProfileStringW" (Indicator: "GetPrivateProfileStringW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "WritePrivateProfileStringW" (Indicator: "WritePrivateProfileStringW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetModuleHandleW" (Indicator: "GetModuleHandleW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStringsW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "lstrcmpW" (Indicator: "lstrcmpW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "lstrcmpiW" (Indicator: "lstrcmpiW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetFileTime" (Indicator: "SetFileTime"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetFullPathNameW" (Indicator: "GetFullPathNameW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "MoveFileW" (Indicator: "MoveFile"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetCurrentDirectoryW" (Indicator: "etCurrentDirectoryW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetFileAttributesW" (Indicator: "GetFileAttributesW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetFileAttributesW" (Indicator: "SetFileAttributesW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CreateFileW" (Indicator: "CreateFileW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetFileSize" (Indicator: "GetFileSize"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetModuleFileNameW" (Indicator: "GetModuleFileNameW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CopyFileW" (Indicator: "CopyFileW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetEnvironmentVariableW" (Indicator: "SetEnvironmentVariableW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetWindowsDirectoryW" (Indicator: "GetWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetTempPathW" (Indicator: "GetTempPathW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLineW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetVersion" (Indicator: "GetVersion"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "lstrlenW" (Indicator: "lstrlenW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpaceW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GlobalLock" (Indicator: "GlobalLock"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CreateThread" (Indicator: "CreateThread"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CreateDirectoryW" (Indicator: "CreateDirectoryW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CreateProcessW" (Indicator: "CreateProcessW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RemoveDirectoryW" (Indicator: "RemoveDirectoryW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "lstrcmpiA" (Indicator: "lstrcmpiA"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetTempFileNameW" (Indicator: "GetTempFileNameW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "lstrcpyA" (Indicator: "lstrcpyA"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "MoveFileExW" (Indicator: "MoveFile"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "lstrcatW" (Indicator: "lstrcatW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetSystemDirectoryW" (Indicator: "GetSystemDirectoryW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "EndPaint" (Indicator: "EndPaint"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "FillRect" (Indicator: "FillRect"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetClientRect" (Indicator: "GetClientRect"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "BeginPaint" (Indicator: "BeginPaint"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "DefWindowProcW" (Indicator: "DefWindowProcW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "InvalidateRect" (Indicator: "InvalidateRect"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "EnableWindow" (Indicator: "EnableWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ReleaseDC" (Indicator: "ReleaseDC"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetDC" (Indicator: "GetDC"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "LoadImageW" (Indicator: "LoadImageW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "IsWindow" (Indicator: "IsWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "wsprintfW" (Indicator: "wsprintfW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ShowWindow" (Indicator: "ShowWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetForegroundWindow" (Indicator: "SetForegroundWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "PostQuitMessage" (Indicator: "PostQuitMessage"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetWindowTextW" (Indicator: "SetWindowTextW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetTimer" (Indicator: "SetTimer"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "DestroyWindow" (Indicator: "DestroyWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ExitWindowsEx" (Indicator: "ExitWindowsEx"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CharNextW" (Indicator: "CharNextW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CreateWindowExW" (Indicator: "CreateWindowExW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SystemParametersInfoW" (Indicator: "SystemParametersInfoW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegisterClassW" (Indicator: "RegisterClassW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ScreenToClient" (Indicator: "ScreenToClient"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetWindowRect" (Indicator: "GetWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "EnableMenuItem" (Indicator: "EnableMenuItem"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetSystemMenu" (Indicator: "GetSystemMenu"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "IsWindowEnabled" (Indicator: "IsWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetWindowPos" (Indicator: "SetWindowPos"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetSysColor" (Indicator: "GetSysColor"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetWindowLongW" (Indicator: "GetWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetCursor" (Indicator: "SetCursor"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "IsWindowVisible" (Indicator: "IsWindow"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CloseClipboard" (Indicator: "CloseClipboard"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SetClipboardData" (Indicator: "SetClipboardData"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "EmptyClipboard" (Indicator: "EmptyClipboard"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "OpenClipboard" (Indicator: "OpenClipboard"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "TrackPopupMenu" (Indicator: "TrackPopupMenu"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CreatePopupMenu" (Indicator: "CreatePopupMenu"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CharNextA" (Indicator: "CharNextA"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "wsprintfA" (Indicator: "wsprintfA"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "DispatchMessageW" (Indicator: "DispatchMessageW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "PeekMessageW" (Indicator: "PeekMessageW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SelectObject" (Indicator: "SelectObject"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CreateFontIndirectW" (Indicator: "CreateFontIndirectW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "DeleteObject" (Indicator: "DeleteObject"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "GetDeviceCaps" (Indicator: "GetDeviceCaps"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SHFileOperationW" (Indicator: "SHFileOperationW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SHGetFileInfoW" (Indicator: "GetFileInfo"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SHBrowseForFolderW" (Indicator: "SHBrowseForFolderW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SHGetPathFromIDListW" (Indicator: "SHGetPathFromIDListW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "ShellExecuteExW" (Indicator: "ShellExecuteExW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegEnumValueW" (Indicator: "RegEnumValueW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegEnumKeyW" (Indicator: "RegEnumKeyW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegQueryValueExW" (Indicator: "RegQueryValueExW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegSetValueExW" (Indicator: "RegSetValueExW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegDeleteValueW" (Indicator: "RegDeleteValueW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegDeleteKeyW" (Indicator: "RegDeleteKeyW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValueW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegOpenKeyExW" (Indicator: "RegOpenKeyExW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "RegCreateKeyExW" (Indicator: "RegCreateKeyExW"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "OleUninitialize" (Indicator: "OleUninitialize"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "OleInitialize" (Indicator: "OleInitialize"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "CoTaskMemFree" (Indicator: "CoTaskMemFree"; in Source: "00000000-00006272.00000000.77011.00408000.00000002.mdmp, 00000000-00006272.00000001.78930.00408000.00000002.mdmp, 00000000-00006272.00000002.80853.00408000.00000002.mdmp") Found string "SHGetFolderPathW" (Indicator: "SHGetFolderPathW"; in Source: "00000000-00006272.00000000.77011.0040A000.00000004.mdmp, 00000000-00006272.00000001.78930.0040A000.00000004.mdmp, 00000000-00006272.00000002.80853.0040A000.00000004.mdmp") Found string "InitiateShutdownW" (Indicator: "InitiateShutdown"; in Source: "00000000-00006272.00000000.77011.0040A000.00000004.mdmp, 00000000-00006272.00000001.78930.0040A000.00000004.mdmp, 00000000-00006272.00000002.80853.0040A000.00000004.mdmp") Found string "RegDeleteKeyExW" (Indicator: "RegDeleteKeyExW"; in Source: "00000000-00006272.00000000.77011.0040A000.00000004.mdmp, 00000000-00006272.00000001.78930.0040A000.00000004.mdmp, 00000000-00006272.00000002.80853.0040A000.00000004.mdmp") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in Source: "00000000-00006272.00000000.77011.0040A000.00000004.mdmp, 00000000-00006272.00000001.78930.0040A000.00000004.mdmp, 00000000-00006272.00000002.80853.0040A000.00000004.mdmp") Found string "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceExW"; in Source: "00000000-00006272.00000000.77011.0040A000.00000004.mdmp, 00000000-00006272.00000001.78930.0040A000.00000004.mdmp, 00000000-00006272.00000002.80853.0040A000.00000004.mdmp") Found string "SetDefaultDllDirectories" (Indicator: "SetDefaultDllDirectories"; in Source: "00000000-00006272.00000000.77011.0040A000.00000004.mdmp, 00000000-00006272.00000001.78930.0040A000.00000004.mdmp, 00000000-00006272.00000002.80853.0040A000.00000004.mdmp") Found string "user32::GetDesktopWindow()" (Indicator: "GetDesktopWindow"; in Source: "00000000-00006272.00000000.77011.02CA0000.00000004.mdmp, 00000000-00006272.00000001.78930.02CA0000.00000004.mdmp, 00000000-00006272.00000002.80853.02CA0000.00000004.mdmp") Found string "user32::SetWindowLongA(i 39,i" (Indicator: "SetWindowLongA"; in Source: "00000000-00006272.00000000.77011.02CA0000.00000004.mdmp, 00000000-00006272.00000001.78930.02CA0000.00000004.mdmp, 00000000-00006272.00000002.80853.02CA0000.00000004.mdmp")2d:T563,"Scientize.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 74260000 "Scientize.exe" loaded module "NTDLL.DLL" at base 777f0000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 709b0000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 720e0000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 74080000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74200000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 71fc0000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76d00000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73fc0000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 739c0000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 72930000 "Scientize.exe" loaded module "KERNEL32.DLL" at base 76c30000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 71f40000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75ca0000 "Scientize.exe" loaded module "COMCTL32" at base 73ae0000 "Scientize.exe" loaded module "COMCTL32.DLL" at base 72270000 "Scientize.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 761d0000 "Scientize.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75df00002e:T4c8,Observed string: "EPXEu~YPEEEPPP~P[Z^XYQMEE2E2t2|2222222222345J5Q55555555" (Indicator: "LoadLibrary") in Source: nsf4E58.tmp Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp2f:T64d,Pattern match: "http://crl.certum.pl/ctsca2021.crl0o" Heuristic match: "#kc;Pct.Ar" Pattern match: "http://repository.certum.pl/ctnca.cer09" Pattern match: "http://repository.certum.pl/ctnca2.cer09" Pattern match: "http://repository.certum.pl/ctsca2021.cer0@" Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "http://crl.certum.pl/ctnca.crl0k" Pattern match: "http://crl.certum.pl/ctnca2.crl0l" Pattern match: "http://subca.ocsp-certum.com01" Pattern match: "http://subca.ocsp-certum.com02" Pattern match: "http://subca.ocsp-certum.com05" Pattern match: "http://www.certum.pl/CPS0" Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "P.ndG/w12Cy|tDhRcUtfDP}+pZnokRm" Heuristic match: "Wmah.Tf" Heuristic match: "zg.Pw" Heuristic match: "ystem.ActivityHistory.Id" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.Protocol.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: "System.ActivityHistory.Id" Heuristic match: "System.IdentityProvider.Name" Heuristic match: "System.SAM.Name" Heuristic match: "System.StructuredQuery.Virtual.Cc" Heuristic match: "System.StructuredQuery.Virtual.To" Heuristic match: "System.StructuredQuery.Is" Heuristic match: "System.Protocol.Name" Heuristic match: "System.AppUserModel.ID" Heuristic match: "System.StructuredQueryType.Implicit.Is"30:T47d,Observed string: "RegEnumKeyW" (Indicator: "RegEnumKey") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "RegEnumKeyW" (Indicator: "RegEnumKey") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp31:T4d1,Observed string: "EPXEu~YPEEEPPP~P[Z^XYQMEE2E2t2|2222222222345J5Q55555555" (Indicator: "GetProcAddress") in Source: nsf4E58.tmp Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp32:Tcb6,Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp Observed string: "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp 00000000-00006272.00000001.78930.00408000.00000002.mdmp 00000000-00006272.00000002.80853.00408000.00000002.mdmp Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00006272.00000000.77011.0040A000.00000004.mdmp 00000000-00006272.00000001.78930.0040A000.00000004.mdmp 00000000-00006272.00000002.80853.0040A000.00000004.mdmp Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00006272.00000000.77011.0040A000.00000004.mdmp 00000000-00006272.00000001.78930.0040A000.00000004.mdmp 00000000-00006272.00000002.80853.0040A000.00000004.mdmp Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00006272.00000000.77011.0040A000.00000004.mdmp 00000000-00006272.00000001.78930.0040A000.00000004.mdmp 00000000-00006272.00000002.80853.0040A000.00000004.mdmp33:Td39,"Scientize.exe" wrote bytes "c0690b77a02f0b7730690b77" to virtual address "0x76B516F4" (part of module "WINDOWS.STORAGE.DLL") "Scientize.exe" wrote bytes "30662076100c207670232076" to virtual address "0x76B515F0" (part of module "WINDOWS.STORAGE.DLL") "Scientize.exe" wrote bytes "80deea7640b6ea76" to virtual address "0x72192090" (part of module "PROPSYS.DLL") "Scientize.exe" wrote bytes "80e87076" to virtual address "0x7772E2F8" (part of module "KERNELBASE.DLL") "Scientize.exe" wrote bytes "c01b0c77" to virtual address "0x75FB02F4" (part of module "SHLWAPI.DLL") "Scientize.exe" wrote bytes "b0bf0b7720340b77a0330b77" to virtual address "0x74C3408C" (part of module "SHELL32.DLL") "Scientize.exe" wrote bytes "0041ea76003dea76608ae276b0ffe4760091e276b007e876e0b6e47650b6e476b0f0e3760092ea7650bce476b0ffe7769041ea7670b7e47610c7ea768004e476" to virtual address "0x76D79058" (part of module "CLBCATQ.DLL") "Scientize.exe" wrote bytes "5007e7769041ea76106ee476606ee47660f8e976a0f9e976b0f0e376608ae276b0ffe476603ce876f0efe97670f0e9760041ea768004e476b007e876b0ffe7760091e276" to virtual address "0x72192048" (part of module "PROPSYS.DLL") "Scientize.exe" wrote bytes "30aeb375" to virtual address "0x76471094" (part of module "RPCRT4.DLL") "Scientize.exe" wrote bytes "10f2e07500b9df75f0918777109de0759092e075c0b4e0755088e075d067e07540b2e075209ce075108ce075a0a4e075507ce07550a9e075c0b3e075805de075c0e6e0759075e075c0eee075a0c4e07500c0e07510d2df7560aae075" to virtual address "0x76FC0228" (part of module "COMBASE.DLL") "Scientize.exe" wrote bytes "00891c77" to virtual address "0x7706E010" (part of module "GDI32.DLL") "Scientize.exe" wrote bytes "80f60b77" to virtual address "0x75FB02AC" (part of module "SHLWAPI.DLL") "Scientize.exe" wrote bytes "60410b77e0300b77" to virtual address "0x76B5176C" (part of module "WINDOWS.STORAGE.DLL") "Scientize.exe" wrote bytes "1036bc762036bc76" to virtual address "0x76FC01A0" (part of module "COMBASE.DLL") "Scientize.exe" wrote bytes "d05f1977007e1977905c1c7740981c77e0a1197720681c77d0d51977104e1977703419773071197700311c7780741c7740121c7720421c77e0af1c77" to virtual address "0x7706E098" (part of module "GDI32.DLL") "Scientize.exe" wrote bytes "70581c7740c51e7740821c77009a1f778078197700731977d0141c77707d1977002d1b776076197720771c77c07c1977904f197710661c7710361c77a07e1c7770a2197730361977" to virtual address "0x7706E0D8" (part of module "GDI32.DLL") "Scientize.exe" wrote bytes "d0e41c77c0e41c77a0dc1c7720b11c7790af1c77f0561c77e086207720c71c7740ec1c7720ee1c77" to virtual address "0x7706E958" (part of module "GDI32.DLL") "Scientize.exe" wrote bytes "40f6e376b007e876409ee376d0d8e37670f0ea76b0f0e3768004e476106ee47670b7e476b0ffe476e0acf37600baea760041ea76608ae2760091e276603ce87660f8e976606ee4765007e77650b8e77640f8ea769041ea7650daea76" to virtual address "0x770FD010" (part of module "SHCORE.DLL") "Scientize.exe" wrote bytes "408a0a77306c0b7770c60b77f0410b7700bd0b7710300b77a0cc0b7720410b7720870b7790840a7760a30b7790a20b77d0f40b77e0030c77a0e10977402c0c7770d8097770c70b7750510f77c0910b7750890b777035097720ef0b77" to virtual address "0x75FB0118" (part of module "SHLWAPI.DLL") "Scientize.exe" wrote bytes "705b0577906a057740370577f06b057770680577d06a0577e0450577e03a0577e0680577b0690577b06b0577b0550577506a0577b0710577406b057730690577806d0577707a057790370577" to virtual address "0x7424D000" (part of module "IMM32.DLL")34:T852,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001596.00000000.67383.00670000.00000002.mdmp 00000000-00001596.00000000.67383.00730000.00000004.mdmp 00000000-00001596.00000001.69301.00670000.00000002.mdmp 00000000-00001596.00000001.69301.00730000.00000004.mdmp 00000000-00001596.00000002.71223.00670000.00000002.mdmp 00000000-00001596.00000002.71223.00730000.00000004.mdmp 00000000-00001596.00000003.78654.00670000.00000002.mdmp 00000000-00001596.00000003.78654.00730000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001596.00000000.67383.00670000.00000002.mdmp 00000000-00001596.00000000.67383.00730000.00000004.mdmp 00000000-00001596.00000001.69301.00670000.00000002.mdmp 00000000-00001596.00000001.69301.00730000.00000004.mdmp 00000000-00001596.00000002.71223.00670000.00000002.mdmp 00000000-00001596.00000002.71223.00730000.00000004.mdmp 00000000-00001596.00000003.78654.00670000.00000002.mdmp 00000000-00001596.00000003.78654.00730000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001596.00000000.67383.00730000.00000004.mdmp 00000000-00001596.00000001.69301.00730000.00000004.mdmp 00000000-00001596.00000002.71223.00730000.00000004.mdmp 00000000-00001596.00000003.78654.00730000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001596.00000000.67383.00730000.00000004.mdmp 00000000-00001596.00000001.69301.00730000.00000004.mdmp 00000000-00001596.00000002.71223.00730000.00000004.mdmp 00000000-00001596.00000003.78654.00730000.00000004.mdmp35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAj3eP////////////9wAAAIh3j/////////////cAAACIAI/////////////3AAAAjwCHiP/3eP/4iIh39wAAAI8AAHePh3B/gHd3APcAAACPAHh3ePjwD3AHcAD3AAAAjwCP9wf4AA8Af/cA9wAAAI93j/d393ePd3/4d/cAAACPd4+HeId//3d493f3AAAAj3d3d3j3d3/3d3d39wAAAIh3iHiP/4d//4d3d/cAAACP////////////+If3AAAAj////////////4iI9wAAAI/////////4/4iIiPcAAACP//////+IiIeP///3AAAAj//////4h3d4////9wAAAI//////iIh3iP////cAAACP////+IiHeHj////3AAAAj////4iIeIiP////9wAAAI////iIh4iI//////cAAACP//+IiIiIiP/////3AAAAj///iIiIiHj/////9wAAAI//+O7oiIiP//////cAAACP/4ZufoiIj//////3AAAAj/+Id37oj///////9wAAAI/4iIiO6P////////AAAACP/4iIiIj///////9wAAAAj/+IiIiI///////3AAAAAI//iIiIj///////cAAAAACP//+IiP//////9wAAAAAAj///////////+AAAAAAAAI///////////3AAAAAADgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAD+AAAB/gAAA/4AAAf+AAAP/gAAH/4AAH/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791208418013,"unified_at":"2026-10-05T13:53:38.013Z","metadata":{"hashes":{"sha256":"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467","sha1":"8b03c20129d58ac90df387c1fa830f47ff23d7db","md5":"a1b76d5d8c07348844740e4b0435e041","sha512":"409243349693908a3632120a0a4f8d5d65954da174e99f44c89eea381c877c481b39a88b728c2e30006a5519786bc0147e133efcc9acc10c2c291bae7cd0b722","ssdeep":"12288:xrAE0M9a6pC19uE9NPUYNpPxXoJw8gTHz6:xrAE04a6s1MyPUYbPiZoT","ssdeep_chunks":["12288:xrAE0M9","12288:rAE0M9a","12288:AE0M9a6","12288:E0M9a6p","12288:0M9a6pC","12288:M9a6pC1","12288:9a6pC19","12288:a6pC19u","12288:6pC19uE","12288:pC19uE9","12288:C19uE9N","12288:19uE9NP","12288:9uE9NPU","12288:uE9NPUY","12288:E9NPUYN","12288:9NPUYNp","12288:NPUYNpP","12288:PUYNpPx","12288:UYNpPxX","12288:YNpPxXo","12288:NpPxXoJ","12288:pPxXoJw","12288:PxXoJw8","12288:xXoJw8g","12288:XoJw8gT","12288:oJw8gTH","12288:Jw8gTHz","12288:w8gTHz6","24576:xrAE0M9","24576:rAE0M9a","24576:AE0M9a6","24576:E0M9a6p","24576:0M9a6pC","24576:M9a6pC1","24576:9a6pC19","24576:a6pC19u","24576:6pC19uE","24576:pC19uE9","24576:C19uE9N","24576:19uE9NP","24576:9uE9NPU","24576:uE9NPUY","24576:E9NPUYN","24576:9NPUYNp","24576:NPUYNpP","24576:PUYNpPx","24576:UYNpPxX","24576:YNpPxXo","24576:NpPxXoJ","24576:pPxXoJw","24576:PxXoJw8","24576:xXoJw8g","24576:XoJw8gT","24576:oJw8gTH","24576:Jw8gTHz","24576:w8gTHz6","12288:xrAE04a","12288:rAE04a6","12288:AE04a6s","12288:E04a6s1","12288:04a6s1M","12288:4a6s1My","12288:a6s1MyP","12288:6s1MyPU","12288:s1MyPUY","12288:1MyPUYb","12288:MyPUYbP","12288:yPUYbPi","12288:PUYbPiZ","12288:UYbPiZo","12288:YbPiZoT"],"imphash":"1f23f452093b5c1ff091a2f9fb4fa3e9"},"file_info":{"file_name":"Scientize.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":632304,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1680007406000,"last_seen":1680038377000,"last_multi_scan":1680038377000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":90,"suspicious_count":21,"malicious_count":4,"total":115},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.328376","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Injector.YSAE-6795","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Guloader","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains reference to Windows native API (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"malicious","value":"Contains native function calls"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to update the user profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify the virtual address space of a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Loads the cryptographic module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to read registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Creates a writable file in a temporary directory"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProcW\" (Indicator: \"CallWindowProc\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"CallWindowProcW\" (Indicator: \"CallWindowProc\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Scientize.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006272)\n \"Scientize.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006272)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00006272-30119-1-00403489","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string:\"GetDiskFreeSpaceExW\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"GetDiskFreeSpaceW\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"GetDiskFreeSpaceW\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]\n Observed string:\"GetDiskFreeSpaceExW\" [Source: 00000000-00006272.00000000.77011.0040A000.00000004.mdmp\n 00000000-00006272.00000001.78930.0040A000.00000004.mdmp\n 00000000-00006272.00000002.80853.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Scientize.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"FindWindow\"[Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed api:\"FindWindow\"[Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Observed string: \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetUserDefaultUILanguage\"[Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed api: \"GetUserDefaultUILanguage\"[Source: 00000000-00006272.00000000.77011.0040A000.00000004.mdmp\n 00000000-00006272.00000001.78930.0040A000.00000004.mdmp\n 00000000-00006272.00000002.80853.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"GetVersion \" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"GetVersion \" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 004034D9h\" at 00000000-00006272-30119-1-00403489","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Scientize.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Scientize.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\ (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Figurlbs (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Figurlbs\\Roman (UID: 00000000-00006272)\n \"Scientize.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Figurlbs\\Roman\\Balderdashes (UID: 00000000-00006272)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"\"Scientize.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00006272)\n \"Scientize.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoW (UID: 00000000-00006272)\n \"Scientize.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00006272)\n \"Scientize.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006272)\n \"Scientize.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00006272)\n \"Scientize.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00006272)\n \"Scientize.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00006272)\n \"Scientize.exe\" called \"GetProcAddress\" with a parameter NotifyWinEvent (UID: 00000000-00006272)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Observed string: \"CreateProcessW\" (Indicator: \"CreateProcess\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"CreateProcessW\" (Indicator: \"CreateProcess\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"ShellExecuteExW\" (Indicator: \"ShellExecute\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"ShellExecuteExW\" (Indicator: \"ShellExecute\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed API string: \"CreateThread\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Observed string: \"MoveFileExW\" (Indicator: \"MoveFile\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"MoveFileW\" (Indicator: \"MoveFile\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"MoveFileW\" (Indicator: \"MoveFile\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp\n Observed string: \"MoveFileExW\" (Indicator: \"MoveFile\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"Observed string:\"CloseHandle\" that closes an open object handle. [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"CreateFileW\" that creates/opens a file or I/O device. [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"lstrcatW\" that appends one string to another. [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"ReadFile\" that reads data from a file or I/O device. [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Observed string: \"SHFileOperationW\" (Indicator: \"SHFileOperation\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"SHFileOperationW\" (Indicator: \"SHFileOperation\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"5\\Justifiable\\Retsforflgelsens.iniuser32::SetWindowLongA(i 39,i ,i )$$\\Spigeret\\Gasflaskernes.dllDllUnregisterServer\"-\\Coveting\\Vvene\\Endeballes.Tur\".\\Saltkars\\Prestricken.NskSoftware\\Boomtowns\\Odious\\refrnsangenRedying%Skovlenes%\\Satchel79.TorError! Can't initialize plug-ins directory. Please try again later.Zarrigerne SetupSpace required: Can't write: Could not find symbol: Could not load: Create folder: Create shortcut: Delete file: Delete on reboot: Error creating shortcut: Error decompressing data! Corrupted installer?ExecShell: Execute: Extract: Extract: error writing to file No OLE for: Output folder: Skipped: Copy Details To ClipboardB K M GAngiohemophiliaError opening file for writing:\" in Source: nsf4E58.tmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:6272:168:WilStaging_02\"\n \"SM0:6272:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Scientize.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 71F40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Scientize.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 763C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"Scientize.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75B20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Scientize.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"Scientize.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"Scientize.exe\" touched \"Property System Both Class Factory\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\" has an writable section named \".data\"\n \"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\" has an writable section named \".ndata\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\" file has an entrypoint instructions - \"sub\tesp, 0x2d4,push\tebx,push\tesi,push\tedi,push\t0x20,pop\tedi,xor\tebx, ebx,push\t0x8001,mov\tdword ptr [esp + 0x14], ebx,mov\tdword ptr [esp + 0x10], 0x40a230,mov\tdword ptr [esp + 0x1c], ebx,call\tdword ptr [0x4080ac],call\tdword ptr [0x4080a8],and\teax, 0xbfffffff,cmp\tax, 6,mov\tdword ptr [0x42a24c], eax,je\t0x4034d9,push\tebx,call\t0x40678a,cmp\teax, ebx,je\t0x4034d9,push\t0xc00,call\teax,mov\tesi, 0x4082b0,push\tesi,call\t0x40671a,push\tesi,call\tdword ptr [0x408150],\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Scientize.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Scientize.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Scientize.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Scientize.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"EMAILADDRESS=Borides247@Fingerkysset.Apa, OU=\"Truller Krimis Gunvas \", O=Livsvariges, L=Gleichen, ST=Niedersachsen, C=DE\" (SHA1: 43:85:9A:30:A5:2B:91:0F:F4:84:89:F9:C2:DE:6D:84:E4:A5:27:F3; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"PangoOT-1.0.typelib\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\Figurlbs\\Roman\\Balderdashes\\PangoOT-1.0.typelib]- [targetUID: 00000000-00006272]\n \"Negativeness.sub\" has type \"data\"- Location: [%TEMP%\\Figurlbs\\Roman\\Balderdashes\\Negativeness.sub]- [targetUID: 00000000-00006272]\n \"nsf4E58.tmp\" has type \"data\"- Location: [%TEMP%\\nsf4E58.tmp]- [targetUID: 00000000-00006272]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"Scientize.exe\" touched file \"C:\\Program Files (x86)\\Common Files\\DESORIENTERINGEN\\ANMRKE\\ENGALLANT\\FARVEDE.INI\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Scientize.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Scientize.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"Scientize.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\VMwareHostOpen.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Scientize.exe\" trying to access non-existent file \"C:\\SCIENTIZE.EXE.LOCAL\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Scientize.exe.Local\\\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\NEGATIVENESS.SUB\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\Negativeness.sub\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\PANGOOT-1.0.TYPELIB\"\n \"Scientize.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\PangoOT-1.0.typelib\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2f","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00006272\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string:\"SystemParametersInfoW\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"SystemParametersInfoW\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Scientize.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00006272)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"Scientize.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\Figurlbs\\Roman\\Balderdashes\\Negativeness.sub (UID: 00000000-00006272)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string:\"OpenClipboard\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"OpenClipboard\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string:\"FindFirstFileW\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"FindNextFileW\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"FindFirstFileW\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]\n Observed string:\"FindNextFileW\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string:\"ExpandEnvironmentStringsW\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"ExpandEnvironmentStringsW\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string:\"GetSystemMetrics\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"GetSystemMetrics\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string:\"AdjustTokenPrivileges\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"SeShutdownPrivilege\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"AdjustTokenPrivileges\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]\n Observed string:\"SeShutdownPrivilege\" [Source: 00000000-00006272.00000000.77011.0040A000.00000004.mdmp\n 00000000-00006272.00000001.78930.0040A000.00000004.mdmp\n 00000000-00006272.00000002.80853.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed string:\"SetFileSecurityW\" which can Sets the security of a file or directory object. [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"SetFileSecurityW\" which can Sets the security of a file or directory object. [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin\n Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string:\"ExitWindowsEx\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"InitiateShutdownW\" [Source: 936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467.bin]\n Observed string:\"ExitWindowsEx\" [Source: 00000000-00006272.00000000.77011.00408000.00000002.mdmp\n 00000000-00006272.00000001.78930.00408000.00000002.mdmp\n 00000000-00006272.00000002.80853.00408000.00000002.mdmp]\n Observed string:\"InitiateShutdownW\" [Source: 00000000-00006272.00000000.77011.0040A000.00000004.mdmp\n 00000000-00006272.00000001.78930.0040A000.00000004.mdmp\n 00000000-00006272.00000002.80853.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00006272-30119-1-00403489","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/69 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.5.0.0\"\n Potential IP \"1.0.0.0\" found in string \"Nullsoft.NSIS.exehead,processorArchitecture=\"*\",type=\"win32\",version=\"1.0.0.0\"C:\\Scientize.exe\"\n Potential IP \"1.0.0.0\" found in string \"Uxtheme,processorArchitecture=\"wow64\",type=\"win32\",version=\"1.0.0.0\"C:\\WINDOWS\\SysWOW64\\UXTHEME.dll\"\n Potential IP \"5.1.0.0\" found in string \"Microsoft.Windows.Shell.shell32,processorArchitecture=\"*\",type=\"win32\",version=\"5.1.0.0\"C:\\WINDOWS\\WindowsShell.Manifest\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"api-ms-win-base-bootconfig-l1-1-0\" (Indicator: \"bootconfig\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Scientize.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz4E37.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Scientize.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsz4E37.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueW@ADVAPI32.DLL at 00000000-00006272-30119-1-00403489","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n GetSystemDirectoryW\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteExW\n FindWindowExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$33","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00006272-30119-1-00403489","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"Scientize.exe\" called \"LoadResource\" (UID: 00000000-00001596)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Scientize.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001596)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"Scientize.exe\" called \"IsWow64Process\" with parameter \"1596\" - (UID: 00000000-00001596)\n \"Scientize.exe\" called \"IsWow64Process\" (UID: 00000000-00001596)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Scientize.exe\" called \"GetWindowTextW\" (UID: 00000000-00001596)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Scientize.exe\" called \"GetActiveWindow\" (UID: 00000000-00001596)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Scientize.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00001596)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Scientize.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001596)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00001596-55555-45-00402E72\n GetTickCount@KERNEL32.DLL at 00000000-00001596-55555-73-00402F14\n GetTickCount@KERNEL32.DLL at 00000000-00001596-55555-44-004032C2\n GetTickCount@KERNEL32.DLL at 00000000-00001596-55555-42-00405ED1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00001596-55555-3-00405ABE\n FindNextFileW@KERNEL32.DLL at 00000000-00001596-55555-33-00401434\n FindFirstFileW@KERNEL32.DLL at 00000000-00001596-55555-24-004066F3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00001596-55555-89-00404814","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00001596-55555-33-00401434","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00001596-55555-41-0040671A\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001596-55555-33-00401434","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$34","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"Scientize.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\VMwareHostOpen.exe\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002c7ac97354f61800e8b1c773@ADVAPI32.dll\"\n \"0e000f00a47ac97354f61800e8b1c773@ADVAPI32.dll\"\n \"0e000f00d87ac97354f61800e8b1c773@ADVAPI32.dll\"\n \"11001200387fc97354f61800e8b1c773@ADVAPI32.dll\"\n \"11001200a47fc97354f61800e8b1c773@ADVAPI32.dll\"\n \"12001300b87fc97354f61800e8b1c773@ADVAPI32.dll\"\n \"12001300e07fc97354f61800e8b1c773@ADVAPI32.dll\"\n \"140015009493c97354f61800e8b1c773@ADVAPI32.dll\"\n \"0d000e000080c97354f61800e8b1c773@SHELL32.dll\"\n \"0d000e005480c97354f61800e8b1c773@SHELL32.dll\"\n \"140015009493c973ecf41800e8b1c773@ADVAPI32.dll\"\n \"0d000e000080c973ecf41800e8b1c773@SHELL32.dll\"\n \"0d000e005480c973ecf41800e8b1c773@SHELL32.dll\"\n \"0e000f00a47ac97394f11800e8b1c773@ADVAPI32.dll\"\n \"0e000f00d87ac97394f11800e8b1c773@ADVAPI32.dll\"\n \"11001200387fc97394f11800e8b1c773@ADVAPI32.dll\"\n \"11001200a47fc97394f11800e8b1c773@ADVAPI32.dll\"\n \"12001300b87fc97394f11800e8b1c773@ADVAPI32.dll\"\n \"12001300e07fc97394f11800e8b1c773@ADVAPI32.dll\"\n \"140015009493c97394f11800e8b1c773@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Scientize.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Scientize.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00001596-55555-99-00405553","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\VMwareHostOpen.exe\" (Indicator: \"vmware\") in Source: 00000000-00001596.00000000.67383.00425000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\VMwareHostOpen.exe\" (Indicator: \"vmware\") in Source: 55555-35-00402C37\n \"Error opening file for writing: C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\VMwareHostOpen.exeClick Retry to try again, orCancel to stop the installation.\" (Indicator: \"vmware\") in Source: 55555-37-00401423\n \"es\\VMwareH0_Open\" (Indicator: \"vmware\") in Source: screen_2.png\n \"rror opening file for writing: C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Figurlbs\\Roman\\Balderdashes\\VMwareHostOpen.exeClick Retry to try again, orCancel to stop the installation.\" (Indicator: \"vmware\") in Source: 55555-68-00403ABE\n \"VMwareHostOpen.exe\" (Indicator: \"vmware\") in Source: 00000000-00001596.00000000.67383.0040A000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Scientize.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00001596.00000000.67383.00CE0000.00000002.mdmp\n 00000000-00001596.00000001.69301.00CE0000.00000002.mdmp\n 00000000-00001596.00000002.71223.00CE0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00001596-55555-68-00403ABE","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Scientize.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00001596-55555-99-00405553","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00001596-55555-1-00403489","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00001596-55555-73-00402F14","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"SetFileSecurityW@ADVAPI32.DLL at 00000000-00001596-55555-38-004058E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00001596-55555-77-00401000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"642359e9f425b61d190091cf","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"FileRepMalware [Misc]","submit_name":"Scientize.exe","analysis_start_time":"2023-03-28T21:19:37+00:00","indicators_count":{"informative":87,"suspicious":27,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"6422e0ed3545d05d5707aed1","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Sonbokli.A","submit_name":"Scientize.exe","analysis_start_time":"2023-03-28T12:43:26+00:00","indicators_count":{"informative":73,"suspicious":21,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}],"processes":[{"pid":6272,"ppid":0,"name":"Scientize.exe","command_line":"","sha256":"936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467","normalized_path":"C:\\Scientize.exe","uid":"00000000-00006272","icon":"$35"}],"all_imported_dlls":["ntdll.dll","gdi32.dll","msvcp_win.dll","shlwapi.dll","profapi.dll","ws2_32.dll","oleacc.dll","oleaccrc.dll","KernelBase.dll","windows.storage.dll","kernel.appcore.dll","comctl32.dll","userenv.dll","version.dll","shfolder.dll","TextInputFramework.dll","wow64win.dll","rpcrt4.dll","cryptbase.dll","riched20.dll","msctf.dll","ntmarta.dll","WinTypes.dll","powrprof.dll","kernel32.dll","advapi32.dll","ole32.dll","oleaut32.dll","uxtheme.dll","win32u.dll","ucrtbase.dll","cfgmgr32.dll","SHCore.dll","clbcatq.dll","wow64cpu.dll","setupapi.dll","usp10.dll","CoreMessaging.dll","gdi32full.dll","msvcrt.dll","sechost.dll","fltLib.dll","propsys.dll","dwmapi.dll","msls31.dll","CoreUIComponents.dll","wow64.dll","user32.dll","shell32.dll","sspicli.dll","bcryptprimitives.dll","combase.dll","imm32.dll","apphelp.dll","Wldap32.dll","nsi.dll","devobj.dll","api-ms-win-core-synch-l1-2-0.dll","lpk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Negativeness.sub","sha256":"ac9956ccf6482269992c0a495dfde38b4241396d8343c18c5f8bbd07198c3ea9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"name":"PangoOT-1.0.typelib","sha256":"dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"name":"nsf4E58.tmp","sha256":"17602ce13b9b138370d6186df927536b57bc80c5c5ed082ce5388a4fdb8008cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"name":"nsz310.tmp","sha256":"17602ce13b9b138370d6186df927536b57bc80c5c5ed082ce5388a4fdb8008cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%TEMP%\\nsf4E58.tmp","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\DESORIENTERINGEN\\ANMRKE\\ENGALLANT\\FARVEDE.INI","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%TEMP%\\Figurlbs\\Roman\\Balderdashes\\Negativeness.sub","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%TEMP%\\Figurlbs","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%TEMP%\\Figurlbs\\Roman","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%TEMP%\\Figurlbs\\Roman\\Balderdashes","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%TEMP%\\Figurlbs\\Roman\\Balderdashes\\PangoOT-1.0.typelib","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"},{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]},{"path":"%TEMP%\\nsz310.tmp","sources":[{"report_type":"sandbox","report_id":"642359e9f425b61d190091cf"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:6272:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]},{"name":"SM0:6272:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6422e0ed3545d05d5707aed1"}]}]}},"report_ids":{"sandbox_job_ids":["642359e9f425b61d190091cf","6422e0ed3545d05d5707aed1"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Guloader Sample 936aa1ea53a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 936aa1ea53a8…. Malware family: Trojan.Guloader. Threat score 100/100. 4/28 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Guloader Sample 936aa1ea53a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 936aa1ea53a8…. Malware family: Trojan.Guloader. Threat score 100/100. 4/28 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/936aa1ea53a82d1bf91ce740167b88e7fd5c84499840de3c1a9ee00c56df3467"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Guloader Sample 936aa1ea53a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 936aa1ea53a8…. Malware family: Trojan.Guloader. Threat score 100/100. 4/28 AV engines flagged this file. 4 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]