26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Kryptic.Generic Sample 98f49e275c93… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 98f49e275c93…. Malware family: Kryptic.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","keywords":["Malicious","Kryptic.Generic","malware analysis","sandbox report","threat intelligence","98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d"],"about":{"@type":"SoftwareApplication","name":"98f49.Spy.exe","applicationCategory":["peexe","executable"],"identifier":"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Kryptic.Generic","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":9,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T17a3,Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin")28:Td6e,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e48b0170e48b0138e68b0192e0966ac9b09fa0feffffffb8e58b0116bc956a38735f2c04000000ece48b01b8e58b0120bc956a0600000000003569010000002fbc956a2a0000000600000038735f2c04000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e58b01000000008e00000044e68b01feffffffcce58b01cf00ed76d600ed76acf76d778e0000004700000044e68b0100000000a0e58b010000000008e68b0195e1e87678140a00feffffffd600ed762f7bff74010000005a004c0d167bff74b1e61cc4 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003568)29:T1369,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MUI\0409\\mscoreeis.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003568)2a:T30a4,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003568)2b:T8b7,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3452" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d7c_IE_EarlyTabStart_0x11c4_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d7c_ConnHashTable<3452>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d7c_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d7c_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d7c_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\https://learn.microsoft.com/" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\InternetExplorerDOMStoreQuota" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_d7c_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\_!SHMSFTHISTORY!_" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex"2c:T470,"teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesTotalVisibleMemorySizeSoftware\Valve\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\MicrProjectManagerosoft\WindProjectManagerows NT\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11" in Source: 00000000-00003568.00000000.78356.0040D000.00000004.mdmp "teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesTotalVisibleMemorySizeSoftware\Valve\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\MicrProjectManagerosoft\WindProjectManagerows NT\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11" in Source: 00000000-00003568.00000000.78356.01432000.00000020.mdmp2d:T116f,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "ADVAPI32.DLL" at base 75970000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70470000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "KERNEL32" at base 76fe0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6af10000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "SHLWAPI.DLL" at base 758f0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEIS.DLL" at base 718c0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "USER32.DLL" at base 75af0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "COMCTL32.DLL" at base 715d0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "USER32" at base 75af0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73830000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "DWMAPI.DLL" at base 73b10000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75760000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "CRYPTBASE.DLL" at base 74c70000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "KERNEL32.DLL" at base 76fe0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "CLBCATQ.DLL" at base 756d0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75d20000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "OLEAUT32.DLL" at base 75220000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "SHELL32.DLL" at base 75df0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "OLE32.DLL" at base 75760000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "PROPSYS.DLL" at base 73a00000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "COMCTL32.DLL" at base 73c70000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "APPHELP.DLL" at base 74c20000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69350000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75040000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74f70000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "URLMON.DLL" at base 750b0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 727c0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a00000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 726a0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "IERTUTIL.DLL" at base 76a40000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75df0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76fe0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "SETUPAPI.DLL" at base 76cd0000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "RPCRT4.DLL" at base 75a20000 "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c200002e:T48c,The input sample is signed with a certificate issued by "CN=GeoTrust TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 0F:C7:7C:58:BB:67:CA:4F:2F:EA:83:18:39:C9:D5:58:7E:51:F3:F8; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 8B:3C:5B:9B:86:7D:4B:E4:6D:1C:B5:A0:1D:45:D6:7D:C8:E9:40:82; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: AD:50:22:04:99:F1:2C:55:3C:03:F7:B4:C1:72:39:2D:B8:FC:73:7B; see report for more information)2f:T12c1,"logo_net_1_.svg" has type "Unknown"- [targetUID: 00000000-00003568] "index-docs_1_.js" has type "Unknown"- [targetUID: 00000000-00003568] "site_1_.css" has type "Unknown"- [targetUID: 00000000-00003568] "ms.jsll-4.min_1_.js" has type "Unknown"- [targetUID: 00000000-00003568] "GSPIESR9.htm" has type "HTML document ASCII text with very long lines (56805) with CRLF line terminators"- [targetUID: 00000000-00003568] "application-not-started_1_.htm" has type "Unknown"- [targetUID: 00000000-00003568] "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_98f49e2" has type "JavaScript source ASCII text with very long lines (427)"- [targetUID: 00000000-00003568] "wcp-consent_1_.js" has type "Unknown"- [targetUID: 00000000-00003568] "docons.29a7210.c559c2a5_1_.eot" has type "Unknown"- [targetUID: 00000000-00003568] "app-could-not-be-started_1_.png" has type "Unknown"- [targetUID: 00000000-00003568] "app-could-not-be-started-details_1_.png" has type "Unknown"- [targetUID: 00000000-00003568] "imagestore.dat" has type "data"- [targetUID: 00000000-00003568] "repair-tool-no-resolution_1_.png" has type "Unknown"- [targetUID: 00000000-00003568] "en-US.4" has type "data"- [targetUID: 00000000-00003568] "favicon_2_.ico" has type "Unknown"- [targetUID: 00000000-00003568] "~DFE121DA504F0539E9.TMP" has type "data"- [targetUID: 00000000-00003568] "~DF238BCBD4529D5DEA.TMP" has type "data"- [targetUID: 00000000-00003568] "~DF2C87C7377B32E98D.TMP" has type "data"- [targetUID: 00000000-00003568] "repair-tool-recommended-changes_1_.png" has type "Unknown"- [targetUID: 00000000-00003568] "repair-tool-changes-complete_1_.png" has type "Unknown"- [targetUID: 00000000-00003568] "_570AECDE-A993-11F1-9E5C-00505691E622_.dat" has type "Unknown"- [targetUID: 00000000-00003568] "RecoveryStore._570AECDC-A993-11F1-9E5C-00505691E622_.dat" has type "Unknown"- [targetUID: 00000000-00003568] "_570AECDF-A993-11F1-9E5C-00505691E622_.dat" has type "Unknown"- [targetUID: 00000000-00003568] "B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D" has type "data"- [targetUID: 00000000-00003568] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "data"- [targetUID: 00000000-00003568] "B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF" has type "data"- [targetUID: 00000000-00003568] "HHZU11OQ.txt" has type "ASCII text with very long lines (592)"- [targetUID: 00000000-00003568] "7QODRL8O.txt" has type "ASCII text with very long lines (580)"- [targetUID: 00000000-00003568] "HNVTSYPF.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00003568] "7YSULACE.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00003568] "NA2EANM8.txt" has type "ASCII text with very long lines (431)"- [targetUID: 00000000-00003568] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "data"- [targetUID: 00000000-00003568] "P0E4S1K5.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00003568] "PWWZHPNI.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00003568] "X6TMCH33.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00003568] "GOO0NHZB.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00003568] "B6EJYBDT.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00003568] "PPGL7DJG.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00003568] "05ZBFT66.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00003568] "4KKPNHYY.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00003568] "QIJ6K350.txt" has type "ASCII text with very long lines (476)"- [targetUID: 00000000-00003568] "HNM8XOK2.txt" has type "ASCII text with very long lines (480)"- [targetUID: 00000000-00003568] "AM54M10J.txt" has type "ASCII text with very long lines (428)"- [targetUID: 00000000-00003568] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959" has type "data"- [targetUID: 00000000-00003568] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "data"- [targetUID: 00000000-00003568] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "data"- [targetUID: 00000000-00003568] "F2CNT4JJ.txt" has type "ASCII text"- [targetUID: 00000000-00003568] "C643MQ13.txt" has type "ASCII text"- [targetUID: 00000000-00003568] "TCVRPA7C.txt" has type "ASCII text"- [targetUID: 00000000-00003568] "0YZZHT7X.txt" has type "ASCII text"- [targetUID: 00000000-00003568] "learn.microsoft_1_.xml" has type "Unknown"- [targetUID: 00000000-00003568]30:Tad1,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTLINK\SYSTEMLINK"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK\SEGOE UI"; Key: ""; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\COMPATIBILITY\98F49E275C93FD2463DA7D05EC5F84800C8C5280F2E87A6661ED0191B730B41D.EXE"; Key: ""; Value: "")31:Tf63,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ERRORDIALOG"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "FOD"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DISABLE"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DATAFILEPATH"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE1"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE2"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE3"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE4"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE5"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE6"; Value: "") "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE7"; Value: "")32:Tc7f,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe.Local\" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\FLTLIB.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\MSVCP140.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\VCRUNTIME140.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\ucrtbase.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll"33:Tcf7,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\MSVCP140.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\ucrtbase.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"34:Teac,"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003568) "98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003568)35:T65d,Found string "CorExitProcess" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: MSCOREEI.DLL) Found string "FlsFree" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: USER32.DLL) Found string "MessageBoxA" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: USER32.DLL) Found string "Sf6lkUPrbQrHvWG" (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d, API is part of module: 98F49E275C93FD2463DA7D05EC5F84800C8C5280F2E87A6661ED0191B730B41D.EXE)36:T504,"msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\853bbde7-64fd-4ae9-8ad0-abff64b414e6.tmp" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\HubApps" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old" "msedge.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\BrowserMetrics-spare.pma"37:T88f,""referenceLocator": "https://github.com/actions/virtual-environments"" (Indicator: "github.com") ""name": "github.com/Azure/go-autorest/autorest/adal"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/azure/go-autorest/autorest/adal@v0.9.21"" (Indicator: "github.com") ""name": "github.com/kisielk/gotool"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/kisielk/gotool@v1.0.0"" (Indicator: "github.com") ""name": "github.com/gogo/protobuf"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/gogo/protobuf@v1.3.2"" (Indicator: "github.com") ""name": "github.com/Azure/go-autorest/autorest/validation"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/azure/go-autorest/autorest/validation@v0.3.1"" (Indicator: "github.com") ""name": "github.com/Azure/go-autorest/autorest/azure/auth"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/azure/go-autorest/autorest/azure/auth@v0.4.2"" (Indicator: "github.com") ""name": "github.com/json-iterator/go"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/json-iterator/go@v1.1.12"" (Indicator: "github.com") ""name": "github.com/cncf/xds/go"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20211011173535-cb28da3451f1"" (Indicator: "github.com") ""name": "github.com/sirupsen/logrus"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/sirupsen/logrus@v1.2.0"" (Indicator: "github.com") ""name": "github.com/golang-jwt/jwt/v4"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.4.2"" (Indicator: "github.com") ""name": "github.com/golang/mock"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/golang/mock@v1.1.1"" (Indicator: "github.com") ""name": "github.com/mattn/go-ieproxy"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/mattn/go-ieproxy@v0.0.1"" (Indicator: "github.com") ""name": "github.com/stretchr/testify"," (Indicator: "github.com") ""referenceLocator": "pkg:golang/github.com/stretchr/testify@v1.7.1"" (Indicator: "github.com")38:T8c7,Observed string: ""curlbible.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlcandi.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldaze.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curldefinition.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlflip.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfriendcollective.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlfrodisiac.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlkalon.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlmix.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curls.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsandpotions.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsdynasty.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsmith.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsnolye.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsofcolor.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlsponge.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curltastic.co"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyair.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlycupcakes.ca"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlboutique.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlygirlzcandy.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyheaven.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlykisses.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshayco.com"," (Indicator: ""curl") in Source: wallet-stable.json Observed string: ""curlyshiny.com"," (Indicator: ""curl") in Source: wallet-stable.json39:Tdeb,Found reference to API ""supplier": "Organization: Sindre Sorhus (sindresorhus@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Vladimir Zapparov (dervus.grim@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: DY (dfcreative@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Fredrik Nicol (fredrik.nicol@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Brian J. Brennan (brianloveswords@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Cristian (botecristian@yahoo.com)"" (Indicator: "@yahoo."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Michael Peyper (mpeyper7@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Craig Spence (craigspence0@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Titus Wormer (tituswormer@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Logan Smyth (loganfsmyth@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Jordan Harband (ljharb@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: John-David Dalton (john.david.dalton@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Dominic Tarr (dominic.tarr@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Luke Edwards (luke.edwards05@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Krishnan Anantheswaran (kananthmail-github@yahoo.com)"" (Indicator: "@yahoo."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Pavel Davydov (typical000@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Vadim Demedes (vdemedes@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Jos F. Romaniello (jfromaniello@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Timothy Gu (timothygu99@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Raynos (raynos2@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Oleg Slobodskoi (oleg008@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Matt Mueller (mattmuelle@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Ben Briggs (beneb.info@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Heather Arthur (fayearthur@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json") Found reference to API ""supplier": "Organization: Ivan Nikulin (ifaaan@gmail.com)"" (Indicator: "@gmail."; File: "manifest.spdx.json")3a:T710,Observed email domain:""supplier": "organization: thorsten lorenz (thlorenz@gmx.de)"" [Source: manifest.spdx.json] Observed email domain:""colourpop.com"," [Source: wallet-stable.json] Observed email domain:""aepop.net"," [Source: wallet-stable.json] Observed email domain:""artpop.com"," [Source: wallet-stable.json] Observed email domain:""avenuepop.com"," [Source: wallet-stable.json] Observed email domain:""bassettbmx.com"," [Source: wallet-stable.json] Observed email domain:""canvasmx.com"," [Source: wallet-stable.json] Observed email domain:""drinkolipop.com"," [Source: wallet-stable.json] Observed email domain:""fashionfunpop.com"," [Source: wallet-stable.json] Observed email domain:""fastandloosebmx.com"," [Source: wallet-stable.json] Observed email domain:""flitebmx.com"," [Source: wallet-stable.json] Observed email domain:""fofopop.com"," [Source: wallet-stable.json] Observed email domain:""gellipop.com"," [Source: wallet-stable.json] Observed email domain:""gforcemx.com"," [Source: wallet-stable.json] Observed email domain:""happipop.com"," [Source: wallet-stable.json] Observed email domain:""hauzofpop.com"," [Source: wallet-stable.json] Observed email domain:""hiccapop.com"," [Source: wallet-stable.json] Observed email domain:""hijabipop.com"," [Source: wallet-stable.json] Observed email domain:""jellypop.la"," [Source: wallet-stable.json] Observed email domain:""kinkbmx.com"," [Source: wallet-stable.json] Observed email domain:""kloudkpop.com"," [Source: wallet-stable.json] Observed email domain:""knitpop.com"," [Source: wallet-stable.json] Observed email domain:""kpop.exchange"," [Source: wallet-stable.json] Observed email domain:""laperlamx.com"," [Source: wallet-stable.json] Observed email domain:""lovepop.com"," [Source: wallet-stable.json]3b:T984,"98f49.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007276) "98f49.Spy.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007276)3c:Tbc1,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp")3d:T75b,""4amscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""6whiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""99centsubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""allieandmickey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""alteregoscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""annabelbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""aspirefashionscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""augustbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""bananasmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""baseballmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautiiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""beautyandwhiskey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bellagracehealthscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""belleandbubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""beyondblessedscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""blingbykey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""boosted-luckey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""bowlingmonkey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""burgeonbleu.com"," (Source: wallet-stable.json, Indicator: "leu.com") ""busybeescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cabbagekey.com"," (Source: wallet-stable.json, Indicator: "key.com") ""coatsandscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""codenxtscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""cognitiontsscrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com") ""concreterosescrubs.com"," (Source: wallet-stable.json, Indicator: "ubs.com")3e:Tee5,Dropped file: "data_3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00004936] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00004940] Dropped file: "f_0004c5" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c5]- [targetUID: 00000000-00004936] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00004936] Dropped file: "f_0004c9" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c9]- [targetUID: 00000000-00004936] Dropped file: "load_statistics.db" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db]- [targetUID: 00000000-00007664] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00004936] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00004936] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1]- [targetUID: 00000000-00004936] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ShaderCache\data_1]- [targetUID: 00000000-00004936] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00004936] Dropped file: "f_0004c6" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c6]- [targetUID: 00000000-00004936] Dropped file: "index" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index]- [targetUID: 00000000-00004936] Dropped file: "History" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00007276] Dropped file: "Web Data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00007664] Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00007664] Dropped file: "Visited Links" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00007664] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00004936] Dropped file: "f993f588-446d-4f8d-8a95-66998d045543.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Ad Blocking\f993f588-446d-4f8d-8a95-66998d045543.tmp]- [targetUID: 00000000-00007664] Dropped file: "Tabs_13350447149216166" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Tabs_13350447149216166]- [targetUID: 00000000-00007664] Dropped file: "853bbde7-64fd-4ae9-8ad0-abff64b414e6.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\853bbde7-64fd-4ae9-8ad0-abff64b414e6.tmp]- [targetUID: 00000000-00007664] Dropped file: "Diagnostic Data-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Diagnostic Data-wal]- [targetUID: 00000000-00007664] Dropped file: "f_0004c3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00004936] Dropped file: "f_0004ca" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004ca]- [targetUID: 00000000-00004936] Dropped file: "975bee25-0453-4d20-8d8f-1970ec546ed2.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\975bee25-0453-4d20-8d8f-1970ec546ed2.tmp]- [targetUID: 00000000-00007664]1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790899782448,"unified_at":"2026-10-02T00:09:42.448Z","metadata":{"hashes":{"sha256":"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","sha1":"cdce7196baa6fd1d509a8283c2376c5f33ed5e77","md5":"08fb66b545df070a74af6cf34dad246b","sha512":"37046b34ab6b6f05e4e0d639f0d1198d2561612ed0e860116b3badbb2451035bf4c5d78062a155d674692302467f37eb434421ae208a7e166f52d3164de4fcfc","ssdeep":"6144:TzvMJngWDh+Qlnjm14CNM75qRvu0bejPLP44WbRWVg3EKG1jsshJVI+zk7GWPvhP:TrMJjPLPRhQ+z4GWhC4s4nd","ssdeep_chunks":["6144:TzvMJng","6144:zvMJngW","6144:vMJngWD","6144:MJngWDh","6144:JngWDh+","6144:ngWDh+Q","6144:gWDh+Ql","6144:WDh+Qln","6144:Dh+Qlnj","6144:h+Qlnjm","6144:+Qlnjm1","6144:Qlnjm14","6144:lnjm14C","6144:njm14CN","6144:jm14CNM","6144:m14CNM7","6144:14CNM75","6144:4CNM75q","6144:CNM75qR","6144:NM75qRv","6144:M75qRvu","6144:75qRvu0","6144:5qRvu0b","6144:qRvu0be","6144:Rvu0bej","6144:vu0bejP","6144:u0bejPL","6144:0bejPLP","6144:bejPLP4","6144:ejPLP44","6144:jPLP44W","6144:PLP44Wb","6144:LP44WbR","6144:P44WbRW","6144:44WbRWV","6144:4WbRWVg","6144:WbRWVg3","6144:bRWVg3E","6144:RWVg3EK","6144:WVg3EKG","6144:Vg3EKG1","6144:g3EKG1j","6144:3EKG1js","6144:EKG1jss","6144:KG1jssh","6144:G1jsshJ","6144:1jsshJV","6144:jsshJVI","6144:sshJVI+","6144:shJVI+z","6144:hJVI+zk","6144:JVI+zk7","6144:VI+zk7G","6144:I+zk7GW","6144:+zk7GWP","6144:zk7GWPv","6144:k7GWPvh","6144:7GWPvhP","12288:TzvMJng","12288:zvMJngW","12288:vMJngWD","12288:MJngWDh","12288:JngWDh+","12288:ngWDh+Q","12288:gWDh+Ql","12288:WDh+Qln","12288:Dh+Qlnj","12288:h+Qlnjm","12288:+Qlnjm1","12288:Qlnjm14","12288:lnjm14C","12288:njm14CN","12288:jm14CNM","12288:m14CNM7","12288:14CNM75","12288:4CNM75q","12288:CNM75qR","12288:NM75qRv","12288:M75qRvu","12288:75qRvu0","12288:5qRvu0b","12288:qRvu0be","12288:Rvu0bej","12288:vu0bejP","12288:u0bejPL","12288:0bejPLP","12288:bejPLP4","12288:ejPLP44","12288:jPLP44W","12288:PLP44Wb","12288:LP44WbR","12288:P44WbRW","12288:44WbRWV","12288:4WbRWVg","12288:WbRWVg3","12288:bRWVg3E","12288:RWVg3EK","12288:WVg3EKG","12288:Vg3EKG1","12288:g3EKG1j","12288:3EKG1js","12288:EKG1jss","12288:KG1jssh","12288:G1jsshJ","12288:1jsshJV","12288:jsshJVI","12288:sshJVI+","12288:shJVI+z","12288:hJVI+zk","12288:JVI+zk7","12288:VI+zk7G","12288:I+zk7GW","12288:+zk7GWP","12288:zk7GWPv","12288:k7GWPvh","12288:7GWPvhP","6144:TrMJjPL","6144:rMJjPLP","6144:MJjPLPR","6144:JjPLPRh","6144:jPLPRhQ","6144:PLPRhQ+","6144:LPRhQ+z","6144:PRhQ+z4","6144:RhQ+z4G","6144:hQ+z4GW","6144:Q+z4GWh","6144:+z4GWhC","6144:z4GWhC4","6144:4GWhC4s","6144:GWhC4s4","6144:WhC4s4n","6144:hC4s4nd"],"imphash":"06eb4d13e1bb2dcafbe526f4a64db1ae"},"file_info":{"file_name":"98f49.Spy.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":427673,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1705867653000,"last_seen":1788658544000,"last_multi_scan":1788658544000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","redlinestealer","informationstealer","backdoor"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":173,"suspicious_count":17,"malicious_count":9,"total":199},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Spyware/Win.Hpdyre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.RedLine","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptic.38","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Pwsx-10019569-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptic.38 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HUAJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.00042031","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.bu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a886e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_anti_VM_strings_targeting_Qemu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.LLX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.DUPW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4579909","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Kryptic.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"RedLineStealer","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"suspicious","value":"References URL in command line"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Reference to an external IP address lookup service identified"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Able to access Steam setting"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"suspicious","value":"The input sample dropped/contains a certificate file"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ocsp.digicert.com0a\", Pattern match: \"http://ocsp.digicert.com0c\", Pattern match: \"crl3.digicert.com/digicerttrustedrootg4.crl0\", Pattern match: \"http://www.digicert.com/cps0\", Pattern match: \"http://ocsp.digicert.com0x\", Pattern match: \"www.digicert.com1$0\", Pattern match: \"http://ocsp.digicert.com0\\\", Pattern match: \"crl3.digicert.com/digicertassuredidrootca.crl0\", Pattern match: \"crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0\", Pattern match: \"crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0\", Pattern match: \"cacerts.digicert.com/digicertassuredidrootca.crt0e\", Pattern match: \"crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s\", Pattern match: \"cacerts.digicert.com/digicerttrustedrootg4.crt0c\", Pattern match: \"cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0\", Pattern match: \"www.digicert.com1!0\", Pattern match: \"cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationA\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\"), Found reference to \"Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\t\" (Indicator: \"SHA384\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"UBeTAEsMXRF\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"file/memory contains long string with (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"LoadResource with parameter {'hModule': '1974403072', 'hResInfo': '2688528'}\" (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 40695-84-0040392E\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 40695-84-0040392E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003568.00000000.78356.002B0000.00000004.mdmp, 00000000-00003568.00000001.78670.002B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 420007; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 422736; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 422983; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003568-00000C2C-236789395\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003568-00000C2C-236789608\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003568-00000C2C-236789948\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00003568-00000C2C-238089899\")\n Found reference to API \"FindWindow\" (Indicator: \"findwindow\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003568)\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003568)\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"IsWow64Process\" with parameter \"3568\" - (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"GetActiveWindow\" (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"USESHORTNAME\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"APPENDPATH\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00003568.00000000.78356.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1\" - (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UninstallCookiesTotalVisibleMemorySizeSoftware\\Valve\\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\\MicrProjectManagerosoft\\WindProjectManagerows NT\\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11\" in Source: 00000000-00003568.00000000.78356.0040D000.00000004.mdmp\n 00000000-00003568.00000000.78356.01432000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2b","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"logo_net_1_.svg\" as clean (type is \"Unknown\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2.dll\" - [base:0; Status:c0000135]\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00003452)\n Launches browser \"iexplore.exe\" (UID: 00000000-00004536)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"iexplore.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76C80000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75A20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002073976a@ADVAPI32.dll\"\n \"0e000f00e473976a@ADVAPI32.dll\"\n \"0e000f005074976a@ADVAPI32.dll\"\n \"11001200d47d976a@ADVAPI32.dll\"\n \"110012007c7e976a@ADVAPI32.dll\"\n \"12001300cc7e976a@ADVAPI32.dll\"\n \"12001300387f976a@ADVAPI32.dll\"\n \"14001500e4b7976a@ADVAPI32.dll\"\n \"1400150000b8976a@ADVAPI32.dll\"\n \"140015001cb8976a@ADVAPI32.dll\"\n \"1700180038b8976a@ADVAPI32.dll\"\n \"0d000e0054b8976a@ADVAPI32.dll\"\n \"1100120064b8976a@ADVAPI32.dll\"\n \"110012007cb8976a@ADVAPI32.dll\"\n \"0d000e009c7f976a@SHELL32.dll\"\n \"0d000e002880976a@SHELL32.dll\"\n \"0f001000ecb9976a@ADVAPI32.dll\"\n \"1400150038ba976a@ADVAPI32.dll\"\n \"1400150054ba976a@ADVAPI32.dll\"\n \"0c000d00a8ba976a@ADVAPI32.dll\"\n \"0c000d00b8ba976a@ADVAPI32.dll\"\n \"0e000f00c8ba976a@ADVAPI32.dll\"\n \"0e000f00dcba976a@ADVAPI32.dll\"\n \"0b000c00f0ba976a@ADVAPI32.dll\"\n \"180019008cbd976a@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" touched \"Network\" (Path: \"HKCU\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" touched \"Application Registration\" (Path: \"HKCU\\CLSID\\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" has an executable section named \".text\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" has an executable section named \".reloc\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" has an executable section named \".mter\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" file has an entrypoint instructions - \"call\t0x40298c,jmp\t0x4012a4,mov\tedi, edi,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],mov\teax, dword ptr [eax],cmp\tdword ptr [eax], 0xe06d7363,jne\t0x40143c,cmp\tdword ptr [eax + 0x10], 3,jne\t0x40143c,mov\teax, dword ptr [eax + 0x14],cmp\teax, 0x19930520,je\t0x401437,cmp\teax, 0x19930521,je\t0x401437,cmp\teax, 0x19930522,je\t0x401437,cmp\teax, 0x1994000,jne\t0x40143c,call\t0x402a22,xor\teax, eax,pop\tebp,ret\t4,push\t0x401400,call\tdword ptr [0x40b05c],xor\teax, eax,ret\t,mov\tedi, edi,push\tebp,mov\tebp, esp,push\tedi,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00000000-00003452) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"iexplore.exe\" (UID: 00000000-00003452) was launched with modified environment variables: \"Path, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"js.monitor.azure.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00003568-00000C2B-229941613]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" [Source: 00000000-00003568-00000C2B-230252256]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreeis.dll\" [Source: 00000000-00003568-00000C2B-230401694]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00003568-00000C2B-230791396]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00003568-00000C2B-231164578]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00003568-00000C2B-231336337]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00000000-00003452)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3452 CREDAT:275457 /prefetch:2\" (UID: 00000000-00004536)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00000000-00003452)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3452 CREDAT:275457 /prefetch:2\" (UID: 00000000-00004536)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2e","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"C:\\Program Files\\Internet Explorer\\iexplore.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"learn.microsoft_1_.xml\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~DFE121DA504F0539E9.TMP\" has type \"data\"\n \"~DF238BCBD4529D5DEA.TMP\" has type \"data\"\n \"~DF2C87C7377B32E98D.TMP\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" reads file \"c:\\program files\\internet explorer\\iexplore.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment using user register activity","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" trying to access non-existent file \"C:\\98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe.Local\\\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" trying to access non-existent file \"C:\\Windows\\system32\\mscoree.dll.local\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" trying to access non-existent file \"C:\\98F49E275C93FD2463DA7D05EC5F84800C8C5280F2E87A6661ED0191B730B41D.EXE.LOCAL\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" trying to access non-existent file \"C:\\98F49E275C93FD2463DA7D05EC5F84800C8C5280F2E87A6661ED0191B730B41D.EXE.CONFIG\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003568.00000000.78356.00830000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"12.9.1.22\"\n \"1.1.21.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"js.monitor.azure.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003568\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")\n Found reference to API \"GetDCEx\" (Indicator: \"GetDC\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")\n Found reference to API \"UnregisterHotKey\" (Indicator: \"UnregisterHotKey\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" tries to directly access volume data \"C:\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" tries to directly access volume data \"Z:\"\n \"iexplore.exe\" tries to directly access volume data \"C:\"\n \"iexplore.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"ZIndicates if the text in the edit control should appear as the default password character.\" (Indicator: \"password\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UninstallCookiesTotalVisibleMemorySizeSoftware\\Valve\\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\\MicrProjectManagerosoft\\WindProjectManagerows NT\\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003568.00000000.78356.0040D000.00000004.mdmp\n 00000000-00003568.00000000.78356.01432000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; Source: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003568.00000000.78356.002B0000.00000004.mdmp, 00000000-00003568.00000001.78670.002B0000.00000004.mdmp\")\n Found string \":\\Windows\\System32\\DriverStore\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003568.00000001.78670.002B0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003568.00000001.78670.002B0000.00000004.mdmp\")\n Found string \":\\Windows\\System32\\DriverStore\\infpub.dat\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003568.00000001.78670.002B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" opened \"\\Device\\KsecDD\"\n \"iexplore.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D has high entropy\"\n \"B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92 has high entropy\"\n \"B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF has high entropy\"\n \"E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959 has high entropy\"\n \"E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"app-could-not-be-started_1_.png\" has type \"Unknown\" and extension \"png\"\n \"app-could-not-be-started-details_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-no-resolution_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-recommended-changes_1_.png\" has type \"Unknown\" and extension \"png\"\n \"repair-tool-changes-complete_1_.png\" has type \"Unknown\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0\" (UID: 00000000-00003452)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"ttps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00003568.00000000.78356.0040D000.00000004.mdmp, 00000000-00003568.00000000.78356.01432000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.109.73 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.28.10 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 23.44.145.44 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 23.38.162.72 on port 443 (TCP)\n Process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" connects to 150.171.109.72 on port 443 (TCP); Domain: \"js.monitor.azure.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10010af5\"\n \"cx\": \"487\"\n \"cy\": \"25\"}\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"6010c50\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"GSPIESR9.htm\" contains indicator \"ActiveXObject\" (Line: 36; Offset: 79466)\n \"GSPIESR9.htm\" contains indicator \".Run\" (Line: 36; Offset: 37214)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n CreateThread\n GetModuleFileNameA\n IsDebuggerPresent\n GetCommandLineA\n GetStartupInfoA\n VirtualProtect\n TerminateProcess\n Sleep\n VirtualAlloc\n LoadLibraryA\n UnhandledExceptionFilter\n GetModuleHandleW\n GetProcAddress\n GetTickCount\n WriteFile","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" has a section named \".mter\"\n \"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d\" has a section named \".HOc8\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d.exe\" called \"ShellExecuteW\" with parameter http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9 (UID: 00000000-00003568)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"98f49.Spy.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"98f49.Spy.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"98f49.Spy.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007276.00000000.66926.02820000.00000004.mdmp, 00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$36","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"98f49.Spy.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"strings.json\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"98f49.Spy.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")\n Found reference to API \"GetMonitorInfo\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"98f49.Spy.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"\"; Value: \"\")\n \"98f49.Spy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"HTTP\"; Value: \"\")\n \"98f49.Spy.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"\"; Value: \"\")\n \"98f49.Spy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"HIDDEN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA HTTP unable to match response to request\" (SID: 2221010, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.62.46.151:443\"\n \"54.202.71.123:443\"\n \"23.62.46.141:443\"\n \"23.62.46.133:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"\"baysidebuddy.com\",\" (Indicator: \"ebuddy.com\"; File: \"wallet-stable.json\")\n Found string \"\"comeherebuddy.com\",\" (Indicator: \"ebuddy.com\"; File: \"wallet-stable.json\")\n Found string \"\"www.facebook.com\",\" (Indicator: \"facebook.com\"; File: \"wallet-stable.json\")\n Found string \"\"linkedin.com\",\" (Indicator: \"linkedin.com\"; File: \"wallet-stable.json\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$37","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"98f49.Spy.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F10000\n \"98f49.Spy.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72810000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00007276-00000C25-40045744]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MUI\\0409\\\\mscoreeis.dll\" [Source: 00000000-00007276-00000C25-40107088]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreeis.dll\" [Source: 00000000-00007276-00000C25-40150662]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\.ses\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7664_596449104\\manifest.fingerprint\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\5974e048-4636-4a01-ad9d-464ed03638ea.tmp\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\53b3506e-74ff-4dc8-b4a6-908d6a40f7e0.tmp\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7664_224600469\\crl-set\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7664_224600469\\manifest.json\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7664_1923323541\\adblock_snippet.js\"\n \"msedge.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\7664_1923323541\\Filtering Rules\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"98f49.Spy.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"98f49.Spy.exe\" queries basic process information of the \"C:\\98f49.Spy.exe\" (UID: 7276)\n \"98f49.Spy.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (UID: 7276)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"98f49.Spy.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"98f49.Spy.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"98f49.Spy.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"98f49.Spy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"98f49.Spy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"98f49.Spy.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"98f49.Spy.exe\" writes file \"%localappdata%\\microsoft\\edge\\user data\\default\\history\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$38","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"History\")\n file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"000003.log\")\n file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"fc89161e-2b38-4867-b2dc-cd9f343bab4f.tmp\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"fc89161e-2b38-4867-b2dc-cd9f343bab4f.tmp\")\n file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"4abb3a03-48f1-4620-be04-846c70f12526.tmp\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"4abb3a03-48f1-4620-be04-846c70f12526.tmp\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"wallet-stable.json\")\n Found string \"\"maps.googleapis.com\",\" (Indicator: \".googleapis.com\"; File: \"wallet-stable.json\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"wallet-pre-stable.json\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"23.62.46.151\" on port \"443\"\n HTTPS traffic to \"54.202.71.123\" on port \"443\"\n HTTPS traffic to \"23.62.46.141\" on port \"443\"\n HTTPS traffic to \"23.62.46.133\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007276\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"\"fingerhut.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json\n Observed string: \"\"fingerlakescoffee.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json\n Observed string: \"\"fingerprintsbylivescan.com\",\" (Indicator: \"\"finger\") in Source: wallet-stable.json","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE2939BEC70C25B1E0AAC0392981C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLE0B1718E718DDEAA40E1B87EA29D6]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE0B1718E718DDEAA40E1B87EA29D6]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"98f49.Spy.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"98f49.Spy.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"19598007528,7008,3024,,RtlGetVersion,NTDLL.dll,\"00:17:29.062\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007276.00000001.68845.02820000.00000004.mdmp, 00000000-00007276.00000002.70768.02820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"98f49.Spy.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"98f49.Spy.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"oftware\\Microsoft\\Office\\16.0\\Outlook\\Capabilities\" in Source: 00000000-00007276.00000001.68845.02820000.00000004.mdmp\n 00000000-00007276.00000002.70768.02820000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 98f49.Spy.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"98f49.Spy.exe\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00007276.00000000.66926.0040B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"98f49.Spy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES (X86)\\MICROSOFT\\EDGE\\APPLICATION\\MSEDGE.EXE\"; Value: \"\"), \"98f49.Spy.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"$3d","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$3e","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"98f49.Spy.exe\" at 00000000-00007276-00000C13-46341564","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"98f49.Spy.exe\" queried SystemProcessInformation at 00000000-00007276-00000C13-46583886 [PID: 7276]\n \"98f49.Spy.exe\" queried SystemProcessInformation at 00000000-00007276-00000C13-46585221 [PID: 7276]\n \"98f49.Spy.exe\" queried SystemProcessInformation at 00000000-00007276-00000C13-46835534 [PID: 7276]\n \"98f49.Spy.exe\" queried SystemProcessInformation at 00000000-00007276-00000C13-46836859 [PID: 7276]\n \"98f49.Spy.exe\" queried SystemProcessInformation at 00000000-00007276-00000C13-47017695 [PID: 7276]\n \"98f49.Spy.exe\" queried SystemProcessInformation at 00000000-00007276-00000C13-47019083 [PID: 7276]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMPRODUCTNAME\")\n \"msedge.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMMANUFACTURER\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"\"SPDXID\": \"SPDXRef-Package-67DC6134B1DC02DEA7797F7B0DA707DAF20C75CB4BF96F0005699D1B57B8F17A\",\" (Indicator: \"000569\")\n \"\"relatedSpdxElement\": \"SPDXRef-Package-67DC6134B1DC02DEA7797F7B0DA707DAF20C75CB4BF96F0005699D1B57B8F17A\",\" (Indicator: \"000569\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 23.62.46.141\"\n \"UDP connection to 23.62.46.133\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"The input sample dropped/contains a certificate file","description":"File \"manifest.cat\" is a certificate (Owner: CN=Microsoft Corporation Third Party Marketplace PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Corporation Third Party Marketplace Root, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 61362ca7000000000002; Valid From: 10/08/2010 23:15:35; Until: 10/08/2034 23:25:35; Fingerprints: MD5=84:39:74:8A:4D:2C:09:E9:5E:2B:8A:CD:AB:65:3C:6D; SHA1=15:5D:43:4F:0E:34:F1:40:A7:95:A4:86:4A:25:31:13:3E:52:8F:3A)\n File \"manifest.cat\" is a certificate (Owner: CN=Build Manifest Signing, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Corporation Third Party Marketplace PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 33000001aaec39123508b8eb700000000001aa; Valid From: 05/11/2023 19:44:24; Until: 05/08/2024 19:44:24; Fingerprints: MD5=F3:C0:E3:FC:9F:EC:54:21:31:FB:75:3C:B3:B1:D3:7A; SHA1=BE:78:F7:57:1E:D1:85:2C:36:D9:94:08:8D:CD:BF:EB:44:D8:83:D3)","origin":"Binary File","mitre_attack_id":"T1588.004","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"\"pingoyportraits.com\",\" (Indicator: \"\"ping\"; File: \"wallet-stable.json\")\n Found string \"\"pingreedetroit.com\",\" (Indicator: \"\"ping\"; File: \"wallet-stable.json\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"98f49.Spy.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F1\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"98f49.Spy.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\CONTENT\"; Key: \"CACHEPREFIX\"; Value: \"0000\")\n \"98f49.Spy.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\COOKIES\"; Key: \"CACHEPREFIX\"; Value: \"Cookie:\")\n \"98f49.Spy.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\HISTORY\"; Key: \"CACHEPREFIX\"; Value: \"Visited:\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"98f49.Spy.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.\" - (UID: 00000000-00007276)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The operation completed successfully. (0x0)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ttps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00007276.00000000.66926.04392000.00000020.mdmp, 00000000-00007276.00000001.68845.0040D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"},{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"intel_graph":{"map":{"Domain:js.monitor.azure.com":{"type":"Domain","value":"js.monitor.azure.com"},"Domain:microsoftmscompoc.tt.omtrdc.net":{"type":"Domain","value":"microsoftmscompoc.tt.omtrdc.net"},"Domain:mscom.demdex.net":{"type":"Domain","value":"mscom.demdex.net"},"Domain:www.bing.com":{"type":"Domain","value":"www.bing.com"},"File:030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07":{"type":"File","value":"030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07"},"File:132a6cb460fb431ed3f9966b29b7b5141c2faca7125f7c4546ecd1335381cc5d":{"type":"File","value":"132a6cb460fb431ed3f9966b29b7b5141c2faca7125f7c4546ecd1335381cc5d"},"File:1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369":{"type":"File","value":"1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369"},"File:1e716b1c49f910ff77ef89ca0c243b789d12dc1352bd99228ff3ac04eb708ba6":{"type":"File","value":"1e716b1c49f910ff77ef89ca0c243b789d12dc1352bd99228ff3ac04eb708ba6"},"File:248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3":{"type":"File","value":"248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3"},"File:26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5":{"type":"File","value":"26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5"},"File:33607ca3e5bbde02fdf5ad6a7de5de84f6e6033d65794e6bd8ae2ba9b382bbda":{"type":"File","value":"33607ca3e5bbde02fdf5ad6a7de5de84f6e6033d65794e6bd8ae2ba9b382bbda"},"File:356eabc4aea2345f94e0f8b7e939487c7a3db337c8d42d099a6f430d080f580e":{"type":"File","value":"356eabc4aea2345f94e0f8b7e939487c7a3db337c8d42d099a6f430d080f580e"},"File:3697ed754b61611c575c3b183cd5c46e35df5f2643b269e5cb745f56d671dcbe":{"type":"File","value":"3697ed754b61611c575c3b183cd5c46e35df5f2643b269e5cb745f56d671dcbe"},"File:45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb":{"type":"File","value":"45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb"},"File:47860dda4fdc8332602792e678b1bb284f3eecb38265c8a65507de48d6da59a0":{"type":"File","value":"47860dda4fdc8332602792e678b1bb284f3eecb38265c8a65507de48d6da59a0"},"File:486bdfe0fd32f1d0bf887c1640ce24d3ce59f9d7cea63cce876edf20b675c78e":{"type":"File","value":"486bdfe0fd32f1d0bf887c1640ce24d3ce59f9d7cea63cce876edf20b675c78e"},"File:4f2f8f273ea80f81d4143a9cfe8be19df82492eaffcc57b41b7ff0521a4dbee3":{"type":"File","value":"4f2f8f273ea80f81d4143a9cfe8be19df82492eaffcc57b41b7ff0521a4dbee3"},"File:5116cb46717b6763e73732f9ff76daf4c8442f7971b6c7e23b84af552e9fe7f4":{"type":"File","value":"5116cb46717b6763e73732f9ff76daf4c8442f7971b6c7e23b84af552e9fe7f4"},"File:522eb47c7d7b65fe3835f78dfa38cfa45fb05fb5bcfdb51cc3c374f7dac99b75":{"type":"File","value":"522eb47c7d7b65fe3835f78dfa38cfa45fb05fb5bcfdb51cc3c374f7dac99b75"},"File:5cb44c643c0982a3eb8a835bf19e0c8b21c11d75f570fd2f8c9cae6874d0893f":{"type":"File","value":"5cb44c643c0982a3eb8a835bf19e0c8b21c11d75f570fd2f8c9cae6874d0893f"},"File:5d7b6f475833666c5f0708ac5099ed06704d76fc6d412f522aeed8dbd8ff3af9":{"type":"File","value":"5d7b6f475833666c5f0708ac5099ed06704d76fc6d412f522aeed8dbd8ff3af9"},"File:6eb70da269010a7bfadd2a9c35ce31128538661a4c81d3860a9662e32db0081d":{"type":"File","value":"6eb70da269010a7bfadd2a9c35ce31128538661a4c81d3860a9662e32db0081d"},"File:83d92e88308de00e06de566282b932b6224112e56e29b2f197a4c47efcde1afa":{"type":"File","value":"83d92e88308de00e06de566282b932b6224112e56e29b2f197a4c47efcde1afa"},"File:8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44":{"type":"File","value":"8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44"},"File:90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21":{"type":"File","value":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21"},"File:913e666eba425eeb244e16fbb55ab2a7b2429ee44aa5fcfdf5410e93de9e8a91":{"type":"File","value":"913e666eba425eeb244e16fbb55ab2a7b2429ee44aa5fcfdf5410e93de9e8a91"},"File:96fa6e90d8084fab6d3ada1807beb7d469cf27df0cb6bf1461ab614c6e770cf6":{"type":"File","value":"96fa6e90d8084fab6d3ada1807beb7d469cf27df0cb6bf1461ab614c6e770cf6"},"File:97819cddd1e89eb4154cc8d9b999eca3f2fc1a7fccb327060868f9d658bbeef3":{"type":"File","value":"97819cddd1e89eb4154cc8d9b999eca3f2fc1a7fccb327060868f9d658bbeef3"},"File:983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7":{"type":"File","value":"983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7"},"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d":{"type":"File","value":"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat RedLineStealer"]}},"File:9b83eeab3402a84c76696127564eec0a4dcce085295028566bfa33c63c7dae69":{"type":"File","value":"9b83eeab3402a84c76696127564eec0a4dcce085295028566bfa33c63c7dae69"},"File:a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05":{"type":"File","value":"a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05"},"File:b1aa66247d26fc127b3e0cabe4f8e904b6c9577a1b6880ddba4d2839caa0c9b1":{"type":"File","value":"b1aa66247d26fc127b3e0cabe4f8e904b6c9577a1b6880ddba4d2839caa0c9b1"},"File:b1b63de44384f3bd65f5ff490b91b5fbabd21f356342e6608a6cd3ded0ae7fb5":{"type":"File","value":"b1b63de44384f3bd65f5ff490b91b5fbabd21f356342e6608a6cd3ded0ae7fb5"},"File:c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332":{"type":"File","value":"c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332"},"File:c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad":{"type":"File","value":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad"},"File:cb7be7aac22e0315f628695d59d6952db1e648f99af5f58bd164300e0387a90f":{"type":"File","value":"cb7be7aac22e0315f628695d59d6952db1e648f99af5f58bd164300e0387a90f"},"File:cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8":{"type":"File","value":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8"},"File:ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6":{"type":"File","value":"ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6"},"File:dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f":{"type":"File","value":"dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f"},"File:e87ac606a12c1d35a12b4a06be4e3f7659000ecbc73ae4551223bcf69f126185":{"type":"File","value":"e87ac606a12c1d35a12b4a06be4e3f7659000ecbc73ae4551223bcf69f126185"},"File:f05f254a6f7a3d1f57301a7dda605629a663270cf88d8fd11e94fa284a587722":{"type":"File","value":"f05f254a6f7a3d1f57301a7dda605629a663270cf88d8fd11e94fa284a587722"},"File:fd3ca3a2a24a73edbec063148c9352c26e9e22b9f584beb93d5e349abd7ad66b":{"type":"File","value":"fd3ca3a2a24a73edbec063148c9352c26e9e22b9f584beb93d5e349abd7ad66b"},"File:fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa":{"type":"File","value":"fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa"},"File:ff34e355c88659e063a78cb88a619717e0061def31ed9ef225faaf23e9f1de68":{"type":"File","value":"ff34e355c88659e063a78cb88a619717e0061def31ed9ef225faaf23e9f1de68"},"Ip:150.171.109.72":{"type":"Ip","value":"150.171.109.72"},"Ip:23.62.46.133":{"type":"Ip","value":"23.62.46.133"},"Ip:23.62.46.141":{"type":"Ip","value":"23.62.46.141"},"Ip:23.62.46.151":{"type":"Ip","value":"23.62.46.151"},"Ip:54.202.71.123":{"type":"Ip","value":"54.202.71.123"},"Ip:63.140.36.112":{"type":"Ip","value":"63.140.36.112"},"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3":{"type":"Threat","value":"RedLineStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1545970737424236484","root":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat RedLineStealer"]}},{"id":"1545970737424236483","root":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","edges":[{"edge_kind":"contacted_ip","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Ip:23.62.46.151"},{"edge_kind":"contacted_ip","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Ip:54.202.71.123"},{"edge_kind":"contacted_ip","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Ip:23.62.46.141"},{"edge_kind":"contacted_ip","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Ip:23.62.46.133"},{"edge_kind":"contacted_domain","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Domain:js.monitor.azure.com"},{"edge_kind":"resolves_to","from_key":"Domain:js.monitor.azure.com","to_key":"Ip:150.171.109.72"},{"edge_kind":"contacted_domain","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Domain:microsoftmscompoc.tt.omtrdc.net"},{"edge_kind":"resolves_to","from_key":"Domain:microsoftmscompoc.tt.omtrdc.net","to_key":"Ip:63.140.36.112"},{"edge_kind":"contacted_domain","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Domain:mscom.demdex.net"},{"edge_kind":"resolves_to","from_key":"Domain:mscom.demdex.net","to_key":"Ip:54.202.71.123"},{"edge_kind":"contacted_domain","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"Domain:www.bing.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.bing.com","to_key":"Ip:23.62.46.151"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","edges":[{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:5116cb46717b6763e73732f9ff76daf4c8442f7971b6c7e23b84af552e9fe7f4"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:f05f254a6f7a3d1f57301a7dda605629a663270cf88d8fd11e94fa284a587722"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:4f2f8f273ea80f81d4143a9cfe8be19df82492eaffcc57b41b7ff0521a4dbee3"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:ff34e355c88659e063a78cb88a619717e0061def31ed9ef225faaf23e9f1de68"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:356eabc4aea2345f94e0f8b7e939487c7a3db337c8d42d099a6f430d080f580e"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:b1b63de44384f3bd65f5ff490b91b5fbabd21f356342e6608a6cd3ded0ae7fb5"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:486bdfe0fd32f1d0bf887c1640ce24d3ce59f9d7cea63cce876edf20b675c78e"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:132a6cb460fb431ed3f9966b29b7b5141c2faca7125f7c4546ecd1335381cc5d"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:5cb44c643c0982a3eb8a835bf19e0c8b21c11d75f570fd2f8c9cae6874d0893f"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:b1aa66247d26fc127b3e0cabe4f8e904b6c9577a1b6880ddba4d2839caa0c9b1"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:5d7b6f475833666c5f0708ac5099ed06704d76fc6d412f522aeed8dbd8ff3af9"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:5d7b6f475833666c5f0708ac5099ed06704d76fc6d412f522aeed8dbd8ff3af9"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:97819cddd1e89eb4154cc8d9b999eca3f2fc1a7fccb327060868f9d658bbeef3"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:cb7be7aac22e0315f628695d59d6952db1e648f99af5f58bd164300e0387a90f"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:fd3ca3a2a24a73edbec063148c9352c26e9e22b9f584beb93d5e349abd7ad66b"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:e87ac606a12c1d35a12b4a06be4e3f7659000ecbc73ae4551223bcf69f126185"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:522eb47c7d7b65fe3835f78dfa38cfa45fb05fb5bcfdb51cc3c374f7dac99b75"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:83d92e88308de00e06de566282b932b6224112e56e29b2f197a4c47efcde1afa"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:6eb70da269010a7bfadd2a9c35ce31128538661a4c81d3860a9662e32db0081d"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:47860dda4fdc8332602792e678b1bb284f3eecb38265c8a65507de48d6da59a0"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:9b83eeab3402a84c76696127564eec0a4dcce085295028566bfa33c63c7dae69"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:1e716b1c49f910ff77ef89ca0c243b789d12dc1352bd99228ff3ac04eb708ba6"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:3697ed754b61611c575c3b183cd5c46e35df5f2643b269e5cb745f56d671dcbe"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:913e666eba425eeb244e16fbb55ab2a7b2429ee44aa5fcfdf5410e93de9e8a91"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:33607ca3e5bbde02fdf5ad6a7de5de84f6e6033d65794e6bd8ae2ba9b382bbda"},{"edge_kind":"extracted","from_key":"File:98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","to_key":"File:96fa6e90d8084fab6d3ada1807beb7d469cf27df0cb6bf1461ab614c6e770cf6"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":29,"spawned_processes_count":29,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":244,"dropped_files_count":0,"extracted_files_count":41,"files_written_count":208,"files_deleted_count":0,"registry_keys_created_count":13,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":13,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":4,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","redlinestealer","informationstealer","backdoor"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a9cc36f951f6290e1045c79","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Kryptik.LLX.gen","contacted_countries":["USA"],"submit_name":"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","analysis_start_time":"2026-09-06T01:35:45+00:00","indicators_count":{"informative":129,"suspicious":10,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65aea614c5ec17d85809990d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"98f49.Spy.exe","analysis_start_time":"2024-01-22T17:29:56+00:00","indicators_count":{"informative":122,"suspicious":23,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.62.46.151","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"address":"54.202.71.123","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"address":"23.62.46.141","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"address":"23.62.46.133","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"dns_resolutions":[{"domain":"js.monitor.azure.com","address":"150.171.109.72","ttl":191,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"domain":"microsoftmscompoc.tt.omtrdc.net","address":"63.140.36.112","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"domain":"mscom.demdex.net","address":"54.202.71.123","ttl":297,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"domain":"www.bing.com","address":"23.62.46.151","ttl":12903,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSEDGE.NET","registrar_creation_date":"1996-01-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}],"processes":[{"pid":7276,"ppid":0,"name":"98f49.Spy.exe","command_line":"","sha256":"98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d","normalized_path":"C:\\98f49.Spy.exe","uid":"00000000-00007276","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7664,"ppid":7276,"name":"msedge.exe","command_line":"--single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=98f49.Spy.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007276","uid":"00000000-00007664"},{"pid":5924,"ppid":7664,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0x168,0x7ffddbcbb208,0x7ffddbcbb218,0x7ffddbcbb228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00005924"},{"pid":7996,"ppid":7664,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00007996"},{"pid":4936,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004936"},{"pid":4940,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1920 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004940"},{"pid":7680,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1061335361 --mojo-platform-channel-handle=2832 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00007680"},{"pid":2996,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1061640916 --mojo-platform-channel-handle=2888 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00002996"},{"pid":7896,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3588 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00007896"},{"pid":7772,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1062230979 --mojo-platform-channel-handle=3688 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00007772"},{"pid":376,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1062506779 --mojo-platform-channel-handle=3748 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00000376"},{"pid":6228,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1062824046 --mojo-platform-channel-handle=3640 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00006228"},{"pid":4048,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1063133626 --mojo-platform-channel-handle=3760 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004048"},{"pid":4404,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --extension-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1063458801 --mojo-platform-channel-handle=3900 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004404"},{"pid":4140,"ppid":7664,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1705972485793681 --launch-time-ticks=1064656886 --mojo-platform-channel-handle=6064 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004140"},{"pid":4916,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6220 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004916"},{"pid":7416,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00007416"},{"pid":5032,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5308 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00005032"},{"pid":3328,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5096 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00003328"},{"pid":4424,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004424"},{"pid":6544,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5492 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00006544"},{"pid":5708,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5388 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00005708"},{"pid":5148,"ppid":7664,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00005148"},{"pid":6688,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00006688"},{"pid":6712,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2552 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00006712"},{"pid":7364,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00007364"},{"pid":4456,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1148 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00004456"},{"pid":6376,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1208 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00006376"},{"pid":2516,"ppid":7664,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 --field-trial-handle=2068,i,1709816460331134375,11033197647625240243,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007664","uid":"00000000-00002516"}],"all_imported_dlls":["cryptbase.dll","schannel.dll","api-ms-win-crt-locale-l1-1-0.dll","propsys.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msimg32.dll","SensApi.dll","ole32.dll","api-ms-win-core-localization-l1-2-0.dll","apphelp.dll","cryptsp.dll","srvcli.dll","shlwapi.dll","RpcRtRemote.dll","msasn1.dll","ntmarta.dll","xmllite.dll","rpcss.dll","ieframe.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","normaliz.dll","netapi32.dll","netutils.dll","d2d1.dll","KernelBase.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-core-file-l1-2-0.dll","MSOHEV.DLL","ws2_32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","npmproxy.dll","wkscli.dll","dhcpcsvc6.dll","dhcpcsvc.dll","vm3dum_loader.dll","rpcrt4.dll","api-ms-win-crt-string-l1-1-0.dll","iertutil.dll","cfgmgr32.dll","credssp.dll","bcryptprimitives.dll","msctf.dll","profapi.dll","setupapi.dll","netprofm.dll","wshqos.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","crypt32.dll","oleaccrc.dll","mscorwks.dll","sxs.dll","jscript9.dll","ucrtbase.dll","api-ms-win-crt-filesystem-l1-1-0.dll","secur32.dll","rsaenh.dll","DWrite.dll","d3d11.dll","SwDir_1231201.dll","msvcp140.dll","version.dll","mswsock.dll","Wldap32.dll","deploy.dll","oleaut32.dll","vcruntime140.dll","ssv.dll","d3d10warp.dll","fltLib.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","mshtml.dll","vm3dum.dll","gdi32.dll","IEShims.dll","sqmapi.dll","dxgi.dll","usp10.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","clbcatq.dll","nlaapi.dll","lpk.dll","api-ms-win-downlevel-user32-l1-1-0.dll","URLREDIR.DLL","vm3dum_10.dll","api-ms-win-crt-convert-l1-1-0.dll","mscoree.dll","mscoreei.dll","ieproxy.dll","dui70.dll","npctrl.dll","urlmon.dll","shell32.dll","FWPUCLNT.DLL","duser.dll","mlang.dll","msvcrt.dll","sechost.dll","userenv.dll","winnsi.dll","bcrypt.dll","api-ms-win-crt-runtime-l1-1-0.dll","VxSSL32.dll","wininet.dll","WSHTCPIP.DLL","winhttp.dll","msimtf.dll","imagehlp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","winmm.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","kernel32.dll","dwmapi.dll","WindowsCodecs.dll","gpapi.dll","comdlg32.dll","cryptnet.dll","t2embed.dll","uxtheme.dll","IPHLPAPI.DLL","oleacc.dll","d3d10level9.dll","tzres.dll","comctl32.dll","devobj.dll","dnsapi.dll","msvcr90.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","rasadhlp.dll","webio.dll","advapi32.dll","nsi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ntdll.dll","user32.dll","wship6.dll","ExplorerFrame.dll","jp2ssv.dll","imm32.dll","api-ms-win-crt-environment-l1-1-0.dll","mscoreeis.dll","sspicli.dll","ieui.dll","ncrypt.dll","wintrust.dll","msvcr100.dll","api-ms-win-core-file-l2-1-0.dll","rmclient.dll","actxprxy.dll","wow64win.dll","kernel.appcore.dll","wtsapi32.dll","vaultcli.dll","msvproc.dll","CoreUIComponents.dll","Windows.Shell.ServiceHostBuilder.dll","winsta.dll","Windows.Media.dll","wlanapi.dll","onramp.dll","Windows.Networking.Connectivity.dll","msmpeg2vdec.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","tbs.dll","Windows.Devices.Enumeration.dll","ResourcePolicyClient.dll","winmmbase.dll","ffmpeg.dll","dsreg.dll","Windows.Web.dll","linkinfo.dll","WinTypes.dll","cldapi.dll","mf.dll","dxva2.dll","dbghelp.dll","oneds.dll","CoreMessaging.dll","microsoft_apis.dll","twinapi.dll","OneCoreCommonProxyStub.dll","win32u.dll","powrprof.dll","msedge_elf.dll","KBDUS.DLL","UIAutomationCore.dll","msedge.dll","dcomp.dll","Windows.Security.Authentication.OnlineId.dll","DolbyDecMFT.dll","msvcp110_win.dll","deviceaccess.dll","gdi32full.dll","msvcp_win.dll","ntasn1.dll","RTWorkQ.dll","atlthunk.dll","SHCore.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","DataExchange.dll","OneCoreUAPCommonProxyStub.dll","aepic.dll","vk_swiftshader.dll","d3dcompiler_47.dll","vulkan-1.dll","samcli.dll","fwbase.dll","Windows.System.Profile.RetailInfo.dll","deviceassociation.dll","mfplat.dll","mfperfhelper.dll","mfsensorgroup.dll","Windows.Security.Authentication.Web.Core.dll","wevtapi.dll","windows.storage.dll","dxilconv.dll","wow64.dll","BitsProxy.dll","libEGL.dll","combase.dll","WofUtil.dll","FirewallAPI.dll","libGLESv2.dll","PCPKsp.dll","wow64cpu.dll","wldp.dll","twinapi.appcore.dll","dpapi.dll","fwpolicyiomgr.dll","CompPkgSup.dll","Windows.UI.dll","mscms.dll","TextInputFramework.dll","directmanipulation.dll","telclient.dll","dmcmnutils.dll","srumapi.dll","biwinrt.dll","D3D12.dll","edputil.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"logo_net_1_.svg","sha256":"8e34f3807b4bf495d8954e7229681da8d0dd101dd6ddc2ad7f90cd2983802b44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"index-docs_1_.js","sha256":"248e4527419f83d1ad1be21a739dfbec5f2718c681fef567d0f16473042559a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"site_1_.css","sha256":"ce405f40f5ebb91ac380b098974e8626360132a4814f3e707854e33eb6fd37a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"ms.jsll-4.min_1_.js","sha256":"a312546b2fd130cd3102454efdc7c97793ac1dc934d8364576489667f6339f05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"GSPIESR9.htm","sha256":"5116cb46717b6763e73732f9ff76daf4c8442f7971b6c7e23b84af552e9fe7f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"application-not-started_1_.htm","sha256":"f05f254a6f7a3d1f57301a7dda605629a663270cf88d8fd11e94fa284a587722","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_98f49e2","sha256":"26373f8fccd9af96ab72be3644bd1bab9f0ae164a75b6dfdaff7adb10583a5c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"wcp-consent_1_.js","sha256":"dfe480ce6e9cb555bc9c43ef78e2f0c2a17705c1f03379545b0e0971ce3ebd1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"docons.29a7210.c559c2a5_1_.eot","sha256":"45b8a577d995132574d682b70d844551ed1372243b09aae63482d32edddf34cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"app-could-not-be-started_1_.png","sha256":"983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"app-could-not-be-started-details_1_.png","sha256":"fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"imagestore.dat","sha256":"4f2f8f273ea80f81d4143a9cfe8be19df82492eaffcc57b41b7ff0521a4dbee3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"repair-tool-no-resolution_1_.png","sha256":"030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"favicon_2_.ico","sha256":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"~DFE121DA504F0539E9.TMP","sha256":"ff34e355c88659e063a78cb88a619717e0061def31ed9ef225faaf23e9f1de68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"~DF238BCBD4529D5DEA.TMP","sha256":"356eabc4aea2345f94e0f8b7e939487c7a3db337c8d42d099a6f430d080f580e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"~DF2C87C7377B32E98D.TMP","sha256":"b1b63de44384f3bd65f5ff490b91b5fbabd21f356342e6608a6cd3ded0ae7fb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"repair-tool-recommended-changes_1_.png","sha256":"c47a383de6dd60149b37dd24825d42d83cb48be0ed094e3fc3b228d0a7bb9332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"repair-tool-changes-complete_1_.png","sha256":"1d4dcee8511d5371fec911660d6049782e12901c662b409a5c675772e9b87369","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"0b6ff1aa-b80f-4eb1-a3ae-d73a4727d138.tmp","sha256":"486bdfe0fd32f1d0bf887c1640ce24d3ce59f9d7cea63cce876edf20b675c78e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"26cedc84-e608-432e-997e-589d3e1cbdce.tmp","sha256":"132a6cb460fb431ed3f9966b29b7b5141c2faca7125f7c4546ecd1335381cc5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"32a6128c-a35b-47ed-84de-a4f36258933a.tmp","sha256":"5cb44c643c0982a3eb8a835bf19e0c8b21c11d75f570fd2f8c9cae6874d0893f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"38f6d3d2-adbe-499f-814d-92bff0065986.tmp","sha256":"b1aa66247d26fc127b3e0cabe4f8e904b6c9577a1b6880ddba4d2839caa0c9b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"5a4c3abc-96ab-47a6-8db4-b466686332c4.tmp","sha256":"5d7b6f475833666c5f0708ac5099ed06704d76fc6d412f522aeed8dbd8ff3af9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"975bee25-0453-4d20-8d8f-1970ec546ed2.tmp","sha256":"5d7b6f475833666c5f0708ac5099ed06704d76fc6d412f522aeed8dbd8ff3af9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"f993f588-446d-4f8d-8a95-66998d045543.tmp","sha256":"97819cddd1e89eb4154cc8d9b999eca3f2fc1a7fccb327060868f9d658bbeef3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"settings.dat","sha256":"cb7be7aac22e0315f628695d59d6952db1e648f99af5f58bd164300e0387a90f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"0b5e22fb-7233-4e0a-a97a-72fa5847cab4.tmp","sha256":"fd3ca3a2a24a73edbec063148c9352c26e9e22b9f584beb93d5e349abd7ad66b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"17d8c5af-70b2-4963-b2fe-540eaae53912.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"21d134e3-6e4f-419b-a31f-ba73e98de15b.tmp","sha256":"e87ac606a12c1d35a12b4a06be4e3f7659000ecbc73ae4551223bcf69f126185","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"3744b63b-728a-4ab6-bc24-f16e27f4d464.tmp","sha256":"522eb47c7d7b65fe3835f78dfa38cfa45fb05fb5bcfdb51cc3c374f7dac99b75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"41cc2a4d-3740-49c5-a492-d0fb600f28f1.tmp","sha256":"83d92e88308de00e06de566282b932b6224112e56e29b2f197a4c47efcde1afa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"853bbde7-64fd-4ae9-8ad0-abff64b414e6.tmp","sha256":"6eb70da269010a7bfadd2a9c35ce31128538661a4c81d3860a9662e32db0081d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"000003.log","sha256":"47860dda4fdc8332602792e678b1bb284f3eecb38265c8a65507de48d6da59a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"LOG","sha256":"9b83eeab3402a84c76696127564eec0a4dcce085295028566bfa33c63c7dae69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"data_0","sha256":"1e716b1c49f910ff77ef89ca0c243b789d12dc1352bd99228ff3ac04eb708ba6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"data_1","sha256":"3697ed754b61611c575c3b183cd5c46e35df5f2643b269e5cb745f56d671dcbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"data_3","sha256":"913e666eba425eeb244e16fbb55ab2a7b2429ee44aa5fcfdf5410e93de9e8a91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"f_0004c3","sha256":"33607ca3e5bbde02fdf5ad6a7de5de84f6e6033d65794e6bd8ae2ba9b382bbda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"manifest.cat","sha256":"96fa6e90d8084fab6d3ada1807beb7d469cf27df0cb6bf1461ab614c6e770cf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"files_written":[{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Variations","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics\\BrowserMetrics-65AF1729-1DF0.pma","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Safe Browsing Network\\Safe Browsing Cookies","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\index","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\LOG","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\LOG","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\LOG","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Session Storage\\000004.log","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\000004.log","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\LOG","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Session Storage\\000003.log","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\5974e048-4636-4a01-ad9d-464ed03638ea.tmp","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\000003.log","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOG","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\53b3506e-74ff-4dc8-b4a6-908d6a40f7e0.tmp","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_224600469\\crl-set","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_224600469\\manifest.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\adblock_snippet.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Filtering Rules","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Filtering Rules-AA","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\LICENSE","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\manifest.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Part-DE","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Part-ES","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Part-FR","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Part-IT","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Part-NL","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Part-RU","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1923323541\\Part-ZH","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_646076065\\manifest.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_646076065\\recovery-component-inner.crx","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\app-setup.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\bnpl\\bnpl.bundle.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\bnpl\\bnpl.bundle.js.LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\bnpl\\bnpl.html","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\bnpl_driver.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\buynow_driver.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\crypto.bundle.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\driver-signature.txt","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\edge_driver.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\hub-signature.txt","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\el\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\fi\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\ko\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-ec\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\el\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\fi\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\ko\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-hub\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-mobile-hub\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\el\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\fi\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\ko\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification-shared\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\el\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\fi\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\ko\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-notification\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\el\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\fi\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\ko\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-shared-components\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\ar\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\de\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\en-GB\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\es\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\fr-CA\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\fr\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\id\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\it\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\ja\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\nl\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\pt-BR\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\pt-PT\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\ru\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\sv\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\zh-Hans\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\i18n-tokenized-card\\zh-Hant\\strings.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\README.md","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\super_coupon.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\wallet-checkout-eligible-sites-pre-stable.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\wallet-checkout-eligible-sites.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\wallet-checkout\\checkoutdata.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\wallet-notification-config.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\wallet-pre-stable.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\wallet-stable.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\json\\wallet\\wallet-tokenization-config.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\load-hub-i18n.bundle.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\manifest.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\manifest.webapp.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Mini-Wallet\\mini-wallet.html","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Mini-Wallet\\miniwallet.bundle.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Mini-Wallet\\miniwallet.bundle.js.LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Mini-Wallet\\_manifest\\spdx_2.2\\bsi.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Mini-Wallet\\_manifest\\spdx_2.2\\manifest.cat","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Mini-Wallet\\_manifest\\spdx_2.2\\manifest.spdx.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Mini-Wallet\\_manifest\\spdx_2.2\\manifest.spdx.json.sha256","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Notification\\notification.bundle.js","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Notification\\notification.bundle.js.LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1548413621\\Notification\\notification.html","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1942450228\\deny_domains.list","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1942450228\\deny_etld1_domains.list","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1942450228\\deny_full_domains.list","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_1942450228\\manifest.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_596449104\\manifest.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"path":"%TEMP%\\7664_596449104\\nav_config.json","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\\CLOCKDATA\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\\IMMERSIVE\\PRODUCTION\\PROPERTY\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\\IMMERSIVE\\PRODUCTION\\TOKEN\\{2B379600-B42B-4FE9-A59C-A312FB934935}\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3452","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d7c_IE_EarlyTabStart_0x11c4_Mutex","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d7c_ConnHashTable<3452>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d7c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d7c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d7c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://learn.microsoft.com/","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d7c_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6a9cc36f951f6290e1045c79"}]},{"name":"Local\\SM0:7276:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"Local\\SM0:7276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]},{"name":"SM0:7276:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65aea614c5ec17d85809990d"}]}]}},"report_ids":{"sandbox_job_ids":["6a9cc36f951f6290e1045c79","65aea614c5ec17d85809990d"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Kryptic.Generic Sample 98f49e275c93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 98f49e275c93…. Malware family: Kryptic.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d"}],["$","meta","4",{"property":"og:title","content":"Malicious Kryptic.Generic Sample 98f49e275c93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 98f49e275c93…. Malware family: Kryptic.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/98f49e275c93fd2463da7d05ec5f84800c8c5280f2e87a6661ed0191b730b41d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Kryptic.Generic Sample 98f49e275c93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 98f49e275c93…. Malware family: Kryptic.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]