23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.Hacktool Sample 99130c7385df… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 99130c7385df…. Malware family: Application.Hacktool. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9","keywords":["Malicious","Application.Hacktool","malware analysis","sandbox report","threat intelligence","99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9"],"about":{"@type":"SoftwareApplication","name":"Microsoft Toolkit.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Application.Hacktool","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T66e,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\8990487b8c05ada1e1febe7dcb6c0410\System.Windows.Forms.ni.dll.aux"25:T7f7,Found string "GetCurrentProcess" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "StrongNameSignatureVerificationEx" (Source: Microsoft Toolkit.exe.bin, API is part of module: CLR.DLL) Found string "DeviceIoControl" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "GetProcAddress" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "OpenProcess" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "VirtualFreeEx" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "CreateRemoteThread" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "EnumSystemFirmwareTables" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNEL32.DLL) Found string "CloseHandle" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "OpenSCManagerW" (Source: Microsoft Toolkit.exe.bin, API is part of module: SECHOST.DLL) Found string "GetSystemFirmwareTable" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNEL32.DLL) Found string "VirtualAllocEx" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "WriteProcessMemory" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "WaitForSingleObject" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNELBASE.DLL) Found string "DeleteService" (Source: Microsoft Toolkit.exe.bin, API is part of module: SECHOST.DLL) Found string "CloseServiceHandle" (Source: Microsoft Toolkit.exe.bin, API is part of module: SECHOST.DLL) Found string "SetProcessWorkingSetSize" (Source: Microsoft Toolkit.exe.bin, API is part of module: KERNEL32.DLL) Found string "DriveType" (Source: Microsoft Toolkit.exe.bin, API is part of module: SHELL32.DLL)26:T532,Found malicious artifacts related to "216.58.214.46": ...URL: http://216.58.214.46/ (AV positives: 1/64 scanned on 02/19/2017 01:37:23) File SHA256: 5a68f56352bdbb4df232396c49375953166ec422a766299d8a73a05d654b3e44 (AV positives: 50/63 scanned on 05/09/2018 17:54:13) File SHA256: 9e17e95393b88bba704f1e6452d9ef27f458578b88a4c33dcaf741b94bea6b3f (AV positives: 55/67 scanned on 05/09/2018 17:47:30) File SHA256: 0cd94a53bc6f1cc9fe9d6f66b1c40b3e2c1cb506c18b34fc98ac32b79582924f (AV positives: 54/67 scanned on 05/09/2018 17:47:18) File SHA256: b29284e52b161cd1c4c771a8fe7fb4871a0ed5c1f03fdfc9e2466badd18cdd68 (AV positives: 55/67 scanned on 05/09/2018 16:47:20) File SHA256: 78fd41934abf1b143f4a11061b88b6e24f6dd3fca2583b5e77e5df9ea9d99562 (AV positives: 53/67 scanned on 05/09/2018 16:19:06) File SHA256: e56784ac6645987f9ef621891b475cdfd3211e69bc1a4ed85cf80b0f7e552a97 (Date: 05/09/2018 05:28:04) File SHA256: b99d58ff800c929e1141f0f4a4d57b837c7c68cc89c090e41780a82a6bb329e4 (Date: 05/09/2018 05:23:50) File SHA256: 0eee7a6f6c32c33ac74c2479a555cf4bbff1fa2aaf5839e1c36b8544edf48f19 (Date: 05/07/2018 03:25:59) File SHA256: 21348b17d4e67d2caf4cd4d35e89e592fbca07fc7180a0f9cee7808320364c9a (Date: 05/07/2018 03:23:41) File SHA256: 14db4fd8872ba2ff4713f345064421c17d99776f74f9fc3a1072c93edef1b25a (Date: 05/03/2018 23:06:59)27:T532,Found malicious artifacts related to "216.58.214.46": ...URL: http://216.58.214.46/ (AV positives: 1/64 scanned on 02/19/2017 01:37:23) File SHA256: 5a68f56352bdbb4df232396c49375953166ec422a766299d8a73a05d654b3e44 (AV positives: 50/63 scanned on 05/09/2018 17:54:13) File SHA256: 9e17e95393b88bba704f1e6452d9ef27f458578b88a4c33dcaf741b94bea6b3f (AV positives: 55/67 scanned on 05/09/2018 17:47:30) File SHA256: 0cd94a53bc6f1cc9fe9d6f66b1c40b3e2c1cb506c18b34fc98ac32b79582924f (AV positives: 54/67 scanned on 05/09/2018 17:47:18) File SHA256: b29284e52b161cd1c4c771a8fe7fb4871a0ed5c1f03fdfc9e2466badd18cdd68 (AV positives: 55/67 scanned on 05/09/2018 16:47:20) File SHA256: 78fd41934abf1b143f4a11061b88b6e24f6dd3fca2583b5e77e5df9ea9d99562 (AV positives: 53/67 scanned on 05/09/2018 16:19:06) File SHA256: e56784ac6645987f9ef621891b475cdfd3211e69bc1a4ed85cf80b0f7e552a97 (Date: 05/09/2018 05:28:04) File SHA256: b99d58ff800c929e1141f0f4a4d57b837c7c68cc89c090e41780a82a6bb329e4 (Date: 05/09/2018 05:23:50) File SHA256: 0eee7a6f6c32c33ac74c2479a555cf4bbff1fa2aaf5839e1c36b8544edf48f19 (Date: 05/07/2018 03:25:59) File SHA256: 21348b17d4e67d2caf4cd4d35e89e592fbca07fc7180a0f9cee7808320364c9a (Date: 05/07/2018 03:23:41) File SHA256: 14db4fd8872ba2ff4713f345064421c17d99776f74f9fc3a1072c93edef1b25a (Date: 05/03/2018 23:06:59)28:T78c,"MicrosoftToolkit2-6-4.exe" wrote bytes "86f9d1cc4ee80000" to virtual address "0xEFB1FA70" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF352570" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF352533" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEF352C1B" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEF352C5B" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEF352BA0" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEF352BC0" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF3526A3" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "65488b0425e0140000" to virtual address "0xEF352B83" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF3526ED" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF3529CC" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF35264E" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF3525EB" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEF352C8B" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "65488b0425e8140000" to virtual address "0xEF352CCB" (part of module "CLR.DLL") "MicrosoftToolkit2-6-4.exe" wrote bytes "654c8b1c25e0140000" to virtual address "0xEF3528CA" (part of module "CLR.DLL")29:Tcea,"MicrosoftToolkitv2.6.4.exe" called "RtlGetVersion" (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac322100000000000000000000000051ed1374f87f000000000000000000000000000000000000a5988230c05600002a0000000000000080bf4b06000000008fec1374f87f0000e0ac322100000000e0ac322100000000000000000000000000000000f87f0000ffffff7fe729000000000000000000000000000000000000d8ce2621000000002a0000000000000069c3df20000000003100000000000000e802000000000000ec0200000000000011000110000000007098f7030000000003a3d471f87f00007098f7030000000000000000000000002b00000000000000000000000000000020b0e52000000000b43fe42000000000e0ce2621 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0000f74f87f00000000000000000000000000000000000000000000000000000000de71f87f00001ec4135ff87f00005013135ff87f00001844e771f87f00002831e771f87f0000fca2e771f87f000000000b5ff87f000000000000f87f0000f8000b5ff87f000005000500095600008667e771f87f00000000000000000000deb11274f87f000001000000000000000000000000000000904f4f060000000058ddf7030000000055d88230c056000051a71274f87f00000500000000000000f8000b5ff87f000001000000000000000000000000000000a0ddf7030000000010332074f87f0000f4e1f703000000007964125ff87f000000020000 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e072f70300000000000000000000000000000000000000001872f703000000000000000000000000000000000000000070fb366df87f0000090000000900000000000000000000001955b54ff87f0000000000000000000018000000000000008873f7030000000020005906000000008073f703000000005073f70300000000d702f463f87f00007874f70300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000001000000000000008073f703000000005073f703000000009873f70300000000557e8230c05600005bb955e20956000074130000 (UID: 00000000-00003064)2a:T4ae,"MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003064)2b:T6aa,"MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003064)2c:T1693,Found reference to API (Indicator: "GetCurrentDirectory"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetTempPath"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "MessageBox"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetObject"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "Sleep"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "CreateDirectory"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetLength"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "StrongNameSignatureVerificationEx"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "MoveFileEx"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "LoadLibrary"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetProcAddress"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "OpenProcess"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "DeleteIpForwardEntry"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "FreeLibrary"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "SetupDiGetClassDevs"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "SetupDiCallClassInstaller"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "VirtualFreeEx"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "CreateRemoteThread"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "CreateIpForwardEntry"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "EnumSystemFirmwareTables"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "OpenService"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "CloseHandle"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "CreateFile"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "OpenSCManagerW"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetModuleHandle"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetExtendedTcpTable"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "SetupDiGetDeviceInstanceId"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "GetSystemFirmwareTable"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "VirtualAllocEx"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "SetupDiRestartDevices"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "WriteProcessMemory"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "CreateService"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "DeleteService"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "CloseServiceHandle"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "NetServerEnum"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "NetApiBufferFree"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found reference to API (Indicator: "SetProcessWorkingSetSize"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin")2d:T5fd,"MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpOav.dll" - [base:0; Status:c0000049] "MicrosoftToolkitv2.6.4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135]2e:T28bb,"MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 740F0000 "MicrosoftToolkitv2.6.4.exe" loaded module "C:\MicrosoftToolkitv2.6.4.exe" at 005C0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\mscoree.dll" at 63CB0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 71A80000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 74010000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 71D20000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\sechost.dll" at 725C0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 73E40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 60720000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\user32.dll" at 71DE0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\win32u.dll" at 71550000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 71CF0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\gdi32full.dll" at 70620000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\msvcp_win.dll" at 714B0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\ucrtbase.dll" at 707C0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\ole32.dll" at 72620000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\combase.dll" at 722B0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 705A0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 72010000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 67C00000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\imm32.dll" at 73D20000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at 63F30000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 73D50000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" at 5FF80000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 720E0000 "MicrosoftToolkitv2.6.4.exe" loaded module "C:\MicrosoftToolkitv2.6.4.exe" at 082A0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\kernel.appcore.dll" at 70490000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\version.dll" at 6B650000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" at 53440000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\vcruntime140_clr0400.dll" at 68650000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 5FD60000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\psapi.dll" at 715C0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 20A00000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" at 51E40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\rpcss.dll" at 20D40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 6EA80000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 6FE40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 6F880000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 6FF40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 6FE30000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" at 5FC10000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" at 48B10000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at 71570000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\SHCore.dll" at 73F60000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\windows.storage.dll" at 708C0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\powrprof.dll" at 70440000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\profapi.dll" at 704B0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" at 51C40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" at 47A60000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\2b185c0f47b7e9417ee580b326bea804\System.ServiceProcess.ni.dll" at 62E70000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" at 4FFB0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" at 46FE0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" at 51B00000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\winnlsres.dll" at 06280000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\en-US\winnlsres.dll.mui" at 06290000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\urlmon.dll" at 65A80000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\imagehlp.dll" at 71DC0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\iertutil.dll" at 672B0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\sspicli.dll" at 70370000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\msIso.dll" at 64530000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\propsys.dll" at 6A8D0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" at 51990000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml.Linq\507b5bed3bf2957922d1b2db71171c58\System.Xml.Linq.ni.dll" at 62DF0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll" at 22380000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll" at 5F0B0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\dwmapi.dll" at 6ECF0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_46b9c4e9edf1cfa5\GdiPlus.dll" at 4FB50000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\DWrite.dll" at 63130000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\msctf.dll" at 72770000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ServiceProfiles\LocalService\AppData\Local\FontCache\~FontCache-System.dat" at 06500000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ServiceProfiles\LocalService\AppData\Local\FontCache\~FontCache-FontFace.dat" at 22720000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Fonts\StaticCache.dat" at 23A90000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" at 06700000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\wldp.dll" at 6F470000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\crypt32.dll" at 71280000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\msasn1.dll" at 704D0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\wintrust.dll" at 71450000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\amsi.dll" at 67860000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\userenv.dll" at 70340000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\V8sqz5yA.dll" at 62DA0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\WindowsCodecs.dll" at 6D310000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" at 60D60000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\en-US\user32.dll.mui" at 06770000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\TextInputFramework.dll" at 63800000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\CoreUIComponents.dll" at 6CEB0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\CoreMessaging.dll" at 6DC00000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\ntmarta.dll" at 6F580000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\WinTypes.dll" at 6CD70000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 71F70000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\Registration\R00000000000d.clb" at 06970000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\riched20.dll" at 69D10000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\usp10.dll" at 6E800000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\msls31.dll" at 6A180000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\rpcss.dll" at 31A40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\DataExchange.dll" at 5BE40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\d3d11.dll" at 6D910000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\dcomp.dll" at 6E2A0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\dxgi.dll" at 6F2B0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\twinapi.appcore.dll" at 6EE70000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\System32\rmclient.dll" at 6EDE00002f:T1d14,"MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 70490000 "MicrosoftToolkitv2.6.4.exe" loaded module "VERSION.DLL" at base 6b650000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 53440000 "MicrosoftToolkitv2.6.4.exe" loaded module "USER32.DLL" at base 71de0000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "MSCOREE.DLL" at base 63cb0000 "MicrosoftToolkitv2.6.4.exe" loaded module "NTDLL" at base 740f0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 722b0000 "MicrosoftToolkitv2.6.4.exe" loaded module "PSAPI.DLL" at base 715c0000 "MicrosoftToolkitv2.6.4.exe" loaded module "KERNEL32.DLL" at base 71a80000 "MicrosoftToolkitv2.6.4.exe" loaded module "RPCRT4.DLL" at base 73e40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 51e40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "OLE32.DLL" at base 72620000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 6ea80000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 722b0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f880000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 705a0000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 5fc10000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 48b10000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "SHELL32.DLL" at base 20d40000 "MicrosoftToolkitv2.6.4.exe" loaded module "ADVAPI32.DLL" at base 74010000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 51c40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 47a60000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.SERV759BFB78#\2B185C0F47B7E9417EE580B326BEA804\SYSTEM.SERVICEPROCESS.NI.DLL" at base 62e70000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 4ffb0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 46fe0000 "MicrosoftToolkitv2.6.4.exe" loaded module "NTDLL.DLL" at base 740f0000 "MicrosoftToolkitv2.6.4.exe" loaded module "KERNEL32" at base 71a80000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 51b00000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\URLMON.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "URLMON.DLL" at base 65a80000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "SSPICLI.DLL" at base 70370000 "MicrosoftToolkitv2.6.4.exe" loaded module "MSISO.DLL" at base 64530000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 51990000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "BCRYPT.DLL" at base 6ff40000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML.LINQ\507B5BED3BF2957922D1B2DB71171C58\SYSTEM.XML.LINQ.NI.DLL" at base 62df0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "UXTHEME.DLL" at base 6ea80000 "MicrosoftToolkitv2.6.4.exe" loaded module "IMM32.DLL" at base 73d20000 "MicrosoftToolkitv2.6.4.exe" loaded module "COMCTL32.DLL" at base 5f0b0000 "MicrosoftToolkitv2.6.4.exe" loaded module "GDI32.DLL" at base 71cf0000 "MicrosoftToolkitv2.6.4.exe" loaded module "GDIPLUS.DLL" at base 4fb50000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 4fb50000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 71010000 "MicrosoftToolkitv2.6.4.exe" loaded module "WLDP.DLL" at base 6f470000 "MicrosoftToolkitv2.6.4.exe" loaded module "AMSI.DLL" at base 67860000 "MicrosoftToolkitv2.6.4.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\V8SQZ5YA.DLL" at base 62da0000 "MicrosoftToolkitv2.6.4.exe" loaded module "WINDOWSCODECS.DLL" at base 6d310000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 0 "MicrosoftToolkitv2.6.4.exe" loaded module "COMCTL32.DLL" at base 60d60000 "MicrosoftToolkitv2.6.4.exe" loaded module "COMCTL32" at base 60d60000 "MicrosoftToolkitv2.6.4.exe" loaded module "OLEAUT32.DLL" at base 72010000 "MicrosoftToolkitv2.6.4.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 71de0000 "MicrosoftToolkitv2.6.4.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 71de0000 "MicrosoftToolkitv2.6.4.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 722b0000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 72770000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 72620000 "MicrosoftToolkitv2.6.4.exe" loaded module "RICHED20.DLL" at base 69d10000 "MicrosoftToolkitv2.6.4.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 5be4000030:T84c,"MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\FLTLIB.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\CRYPTSP.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\BCRYPT.DLL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\bcrypt.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL"31:T5cf,"MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\MICROSOFTTOOLKITV2.6.4.EXE.CONFIG" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MICROSOFTTOOLKITV2.6.4.EXE.LOG" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\MicrosoftToolkitv2.6.4.exe.config" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\MICROSOFT TOOLKIT" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\MICROSOFTTOOLKITV2.6.4.INI" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\MicrosoftToolkitv2.6.4.INI" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\ProgramData\MICROSOFT TOOLKIT" "MicrosoftToolkitv2.6.4.exe" trying to access non-existent file "C:\ProgramData\Microsoft Toolkit\SETTINGS.XML"32:T7e2,"MicrosoftToolkitv2.6.4.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft Toolkit\* (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter b138f79dea860272ebe6694d9b73f656 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter ece80f2e3752a779e894fd45d8f27e64 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter 2b185c0f47b7e9417ee580b326bea804 (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\* (UID: 00000000-00003064) "MicrosoftToolkitv2.6.4.exe" called "FindNextFileW" with parameter 5ee35debfc22f727e70e4479ddcbc045 (UID: 00000000-00003064)33:Tc48,Found string "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeMachineAccountPrivilege" (Indicator: "SeMachineAccountPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeSystemProfilePrivilege" (Indicator: "SeSystemProfilePrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeSystemtimePrivilege" (Indicator: "SeSystemtimePrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeRemoteShutdownPrivilege" (Indicator: "SeRemoteShutdownPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin") Found string "SeUndockPrivilege" (Indicator: "SeUndockPrivilege"; File: "99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin")34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7u7u7u7u7ru7u7u7u7sAAO7u7u7u7u67u7u7u7u7AADu7u7u7u7uu7u7u7u7uwAA7u7u7u7u7ru7u7u7u7sAAO7u7u7u7u67u7u7u7u7AADu7u7u7u7uu7u7u7u7uwAA7u7u7u7u7ru7u7u7u7sAAO7u7u7u7u67u7u7u7u7AADu7u7u7u7uu7u7u7u7uwAA7u7u7u7u7ru7u7u7u7sAAO7u7u7u7u67u7u7u7u7AADu7u7u7u7uu7u7u7u7uwAA7u7u7u7u7ru7u7u7u7sAAO7u7u7u7u67u7u7u7u7AACZmZmZmZmZMzMzMzMzMwAAmZmZmZmZmTMzMzMzMzMAAJmZmZmZmZkzMzMzMzMzAACZmZmZmZmZMzMzMzMzMwAAmZmZmZmZmTMzMzMzMzMAAJmZmZmZmZkzMzMzMzMzAACZmZmZmZmZMzMzMzMzMwAAmZmZmZmZmTMzMzMzMzMAAJmZmZmZmZkzMzMzMzMzAACZmZmZmZmZMzMzMzMzMwAAmZmZmZmZmTMzMzMzMzMAAJmZmZmZmZkzMzMzMzMzAACZmZmZmZmZMzMzMzMzMwAAmZmZmZmZmTMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////gAYAH4AGAB+ABgAfgAYAH4AGAB+ABgAfgAYAH4AGAB+ABgAfgAYAH4AGAB+ABgAf//////////+ABgAfgAYAH4AGAB+ABgAfgAYAH4AGAB+ABgAfgAYAH4AGAB+ABgAfgAYAH4AGAB////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790307355182,"unified_at":"2026-09-25T03:35:55.182Z","metadata":{"hashes":{"sha256":"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9","sha1":"2b6d05f9cde75049414433994ab5482c2795086d","md5":"d77b38f887a7d6b842d05ada38a57bcc","sha512":"78e8a25c5442d6619d8de81a39bcf3307acaaecb7d52aa6b2e0c24fa7b8d5897957d8bc3f4e54cb2391d3019ee203bd2e08121c852ed2c6bea4531af86a02870","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Microsoft Toolkit.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":59192832,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1526065626000,"last_seen":1768759683000,"last_multi_scan":1768759683000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Found","ipamor","botnet","gh0st","gh0strat","madang","pykspa","ransomware","rat","trat","virut","wanaransomware","autokms","hackkms"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":81,"suspicious_count":20,"malicious_count":8,"total":109},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.AutoKMS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"PUA/W32.PUP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Hacktool.ACU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Virtool.Win32.AutoKMS.vb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.LEUX-7394","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_60.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.KMSAuto.Win32.8018","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Application.Hacktool","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/techniques/T1168","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open/control a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"informative","value":"Contains ability to start/interact with device drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to write to a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the cryptographic module DLL"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00016656-00002212-0000010C-1374245\n \"\" queries volume information of \"C:\\Microsoft Toolkit.exe\" at 00016656-00002212-0000010C-1403489\n \"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml.Linq\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.Linq.dll\" at 00016656-00002212-0000010C-2334801\n \"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml.Linq\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.Linq.dll\" at 00016656-00002212-0000010C-2334838","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"216.58.214.46:443\"\n \"216.58.214.46:80\"\n \"87.243.6.136:62473\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A4E0000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69980000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Settings.xml\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$24","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"D>k#*l.BN\"\n Heuristic match: \"pY#;5SA.MK\"\n Heuristic match: \"=905Hk.Nl\"\n Heuristic match: \"-H>a>8^.Et\"\n Heuristic match: \"F9G6V.Mc\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00016656-00002212-00000105-1535136","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"m@i.j\"\n Pattern match: \"2d@h.9a\"\n Pattern match: \"74v@sj.opl\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.2\"\n \"255.255.255.0\"\n \"2.6.4.0\"\n Heuristic match: \"255.255.255.0\"\n Heuristic match: \"127.0.0.2\"\n Heuristic match: \"10.3.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\Microsoft Toolkit.exe\" marked \"%ALLUSERSPROFILE%\\Microsoft Toolkit\\Settings.xml\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%ALLUSERSPROFILE%\\Microsoft Toolkit\\Settings.xml\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$25","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/65 Antivirus vendors marked sample as malicious (21% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/65 Antivirus vendors marked sample as malicious (21% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Found an indicator for a scheduled task trigger","description":"\"BootTrigger\" (Indicator: \"BootTrigger\"; File: \"Microsoft Toolkit.exe.bin\")\n \"LogonTrigger\" (Indicator: \"LogonTrigger\"; File: \"Microsoft Toolkit.exe.bin\")\n \"BootTriggerT\" (Indicator: \"BootTrigger\"; File: \"Microsoft Toolkit.exe.bin\")\n \"Type)Microsoft.Win32.TaskScheduler.BootTrigger;\" (Indicator: \"BootTrigger\"; File: \"Microsoft Toolkit.exe.bin\")\n \"LogonTriggerT\" (Indicator: \"LogonTrigger\"; File: \"Microsoft Toolkit.exe.bin\")\n \"Type*Microsoft.Win32.TaskScheduler.LogonTrigger]\" (Indicator: \"LogonTrigger\"; File: \"Microsoft Toolkit.exe.bin\")","origin":"File/Memory","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 87.243.6.136 on port 62473","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at F2820000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 20.189.173.22 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found string \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found string \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found string \"SetupDiGetClassDevs\" (Indicator: \"SetupDiGetClassDevs\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"Found string \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found string \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"VirtualFreeEx\" (Indicator: \"VirtualFree\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service (API string)","description":"Found string \"OpenService\" (Indicator: \"OpenService\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found string \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write to a remote process (API string)","description":"Found string \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003064.00000001.80521.222C3000.00000004.mdmp\n 00000000-00003064.00000002.82443.222C3000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found string \"=\"Uses CryptProtectData and CryptUnProte\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003064.00000001.80521.222C3000.00000004.mdmp\n 00000000-00003064.00000002.82443.222C3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetWindowTextW\" with parameter \"Microsoft Toolkit 2.6.4\" - (UID: 00000000-00003064)\n \"MicrosoftToolkitv2.6.4.exe\" called \"GetWindowTextW\" (UID: 00000000-00003064)\n \"MicrosoftToolkitv2.6.4.exe\" called \"GetWindowTextW\" with parameter \"Information Console\" - (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetActiveWindow\" (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MicrosoftToolkitv2.6.4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found string \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found string \"SetupDiGetClassDevs\" (Indicator: \"SetupDiGetClassDevs\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found string \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Microsoft Toolkit (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found string \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found string \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Found string \"CreateFile\" (Indicator: \"CreateFile\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found string \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found string \"LogonUser\" (Indicator: \"LogonUser\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found string \"MoveFileEx\" (Indicator: \"MoveFile\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains ability to start/interact with device drivers (API string)","description":"Found string \"SeLoadDriverPrivilege\" (Indicator: \"LoadDriver\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found string \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$2e","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"MicrosoftToolkitv2.6.4.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 67860000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"MicrosoftToolkitv2.6.4.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 53440000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"MicrosoftToolkitv2.6.4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 73E40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"MicrosoftToolkitv2.6.4.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 705A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c71871f87f0000@ntdll.dll\"\n \"220023000000000018c71871f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"MicrosoftToolkitv2.6.4.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found string \"CreateService\" (Indicator: \"CreateService\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found string \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"Settings.xml\" has type \"ASCII text with CRLF line terminators\" - Location: [%ALLUSERSPROFILE%\\Microsoft Toolkit\\Settings.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found string \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found string \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003064\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLE7EEA6F80317BA66F30296BA69F7F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003064.00000002.82443.06400000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE7EEA6F80317BA66F30296BA69F7F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003064.00000002.82443.222C3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Found string \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found string \"NetServerEnum\" (Indicator: \"NetServerEnum\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found string \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found string \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found string \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found string \"859909,1740,3025,,RtlGetNtProductType,NTDLL.dll,\"00:20:28.718\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00003064.00000001.80521.06400000.00000004.mdmp, 00000000-00003064.00000002.82443.06400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found string \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"MicrosoftToolkitv2.6.4.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found string \"SeLoadDriverPrivilege\" (Indicator: \"SeLoadDriverPrivilege\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonatePrivilege\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")\n Found string \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonate\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found string \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"MicrosoftToolkitv2.6.4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"MicrosoftToolkitv2.6.4.exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"syswow64\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003064.00000000.78600.06400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"MicrosoftToolkitv2.6.4.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":92,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["Found","ipamor","botnet","gh0st","gh0strat","madang","pykspa","ransomware","rat","trat","virut","wanaransomware","autokms","hackkms"],"sample_flags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"sandbox_reports":[{"id":"6440fb63c457609c090b406d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool","submit_name":"Microsoft Toolkit v2.6.4.exe","analysis_start_time":"2023-04-20T08:44:29+00:00","indicators_count":{"informative":80,"suspicious":29,"malicious":3},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"610af264599342344248db98","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool","contacted_countries":["USA"],"submit_name":"Microsoft Toolkit 2-6-4.exe","analysis_start_time":"2021-08-04T20:02:53+00:00","indicators_count":{"informative":10,"suspicious":15,"malicious":5},"tags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"5bb4aa9b7ca3e15cdf564553","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RiskTool.HackKMS","submit_name":"Microsoft Toolkit.exe","analysis_start_time":"2018-10-03T12:44:03+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":5},"tags":["Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"5b07c92c7ca3e15b4d768173","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RiskTool.HackKMS","submit_name":"Microsoft Toolkit 2-6-4.exe","analysis_start_time":"2018-05-26T02:25:03+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":5},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5af5e9da7ca3e17ddb3f5a07","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RiskTool.HackKMS","contacted_countries":["ROU","USA"],"submit_name":"Microsoft Toolkit.exe","analysis_start_time":"2018-05-11T20:05:52+00:00","indicators_count":{"informative":9,"suspicious":12,"malicious":7},"tags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"216.58.214.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"address":"216.58.214.46","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"address":"87.243.6.136","port":62473,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"address":"20.189.173.22","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}],"processes":[{"pid":2212,"ppid":0,"name":"Microsoft Toolkit.exe","command_line":"","sha256":"99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9","normalized_path":"C:\\Microsoft Toolkit.exe","uid":"00016656-00002212","icon":"$34"}],"all_imported_dlls":["rpcss.dll","cryptbase.dll","clrjit.dll","shell32.dll","tzres.dll","shlwapi.dll","gdi32.dll","lpk.dll","msvcr120_clr0400.dll","mscorlib.dll","System.Xml.ni.dll","nlssorting.dll","crypt32.dll","ntdll.dll","mscoree.dll","advapi32.dll","uxtheme.dll","Wldap32.dll","ole32.dll","rsaenh.dll","oleaut32.dll","System.Windows.Forms.ni.dll","System.ServiceProcess.ni.dll","urlmon.dll","System.Xml.Linq.dll","sechost.dll","mscoreei.dll","user32.dll","imm32.dll","profapi.dll","System.Drawing.ni.dll","wininet.dll","sspicli.dll","System.ni.dll","System.Configuration.ni.dll","version.dll","ntmarta.dll","System.Management.ni.dll","System.Windows.Forms.dll","comctl32.dll","kernel32.dll","mscorlib.ni.dll","iertutil.dll","rpcrt4.dll","usp10.dll","msctf.dll","clr.dll","cryptsp.dll","System.Core.ni.dll","msasn1.dll","KernelBase.dll","msvcrt.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","System.Xml.Linq.ni.dll","riched20.dll","RpcRtRemote.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll","mscorrc.dll","WindowsCodecs.dll","normaliz.dll","api-ms-win-downlevel-version-l1-1-0.dll","GdiPlus.dll","api-ms-win-core-xstate-l2-1-0.dll","dwmapi.dll","clbcatq.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","VxSSL64.dll","bcrypt.dll","nsi.dll","vcruntime140_clr0400.dll","ws2_32.dll","psapi.dll","ucrtbase_clr0400.dll","api-ms-win-core-synch-l1-2-0.dll","win32u.dll","DWrite.dll","WinTypes.dll","gdi32full.dll","wintrust.dll","V8sqz5yA.dll","DataExchange.dll","bcryptprimitives.dll","powrprof.dll","winnlsres.dll","imagehlp.dll","CoreMessaging.dll","msIso.dll","dxgi.dll","twinapi.appcore.dll","cfgmgr32.dll","kernel.appcore.dll","windows.storage.dll","dcomp.dll","fltLib.dll","combase.dll","TextInputFramework.dll","SHCore.dll","wldp.dll","msvcp_win.dll","amsi.dll","rmclient.dll","ucrtbase.dll","CoreUIComponents.dll","propsys.dll","d3d11.dll","msls31.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Settings.xml","sha256":"ccf8796cc4edf0d15ed986a8f32033a9c693ac634ee625ce778d5323939221c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"C:\\Microsoft Toolkit.exe.config","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"C:\\Microsoft Toolkit.exe","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Serv759bfb78#\\319fd6ed651b170e31bdad3076463dba\\System.ServiceProcess.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft Toolkit","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\7152ca3b4e8d992fb4be5317321c2ee5\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\a28d99c0b82e7decf411fb2587cce83f\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml.Linq\\7950655216951a291ff375b54d5e33fd\\System.Xml.Linq.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml.Linq\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.Linq.dll","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"C:\\Microsoft Toolkit 2-6-4.exe.config","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"C:\\Microsoft Toolkit 2-6-4.exe","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\47e0be927382f169f5de470fab0ceb7d\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\43d86904e41b891e07c2ce8a20996e2c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\617299d2bd5dcfe094cedface0c39d1c\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\6377e62f5726b3972e7438dbf11dbe67\\System.ServiceProcess.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\8089ab42d28c269586b8d72c8e01701c\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\f5db2f7c181e6f1344c9bc8dbcffce3b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\38470d5ed01fd95e48dcf4e1b0b4774e\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\229bcb0a37da96387ccb65d0db58b482\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\52f1d02687370fd236b1b3cd518f4156\\System.Xml.Linq.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"C:\\MicrosoftToolkit2-6-4.exe.config","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"C:\\MicrosoftToolkit2-6-4.exe","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\ece80f2e3752a779e894fd45d8f27e64\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Serv759bfb78#\\2b185c0f47b7e9417ee580b326bea804\\System.ServiceProcess.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml.Linq\\507b5bed3bf2957922d1b2db71171c58\\System.Xml.Linq.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\b138f79dea860272ebe6694d9b73f656\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"path":"C:\\99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.exe.config","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"C:\\99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9.exe","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\pubpol109.dat","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb36278a0a934ae244f843b62229421c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\3c20a6b0ca532bcc6271bf4b7ad0b4d9\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Serv759bfb78#\\0159428d78a626c0f3e89e2907d24598\\System.ServiceProcess.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\bf505bb2c2b60e7a40740888cd2c3172\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\7aa0dcace3b5d10b626540709537d280\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\ce9750286ad44cbfb2acf176df9df0a2\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\c19db88873f99eb2f7660bd1fe2f6b71\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml.Linq\\bfb84d0ebdd0bba4d4f6d02497bf1665\\System.Xml.Linq.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft Toolkit\\Settings.xml","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"key":"SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"610af264599342344248db98"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"5bb4aa9b7ca3e15cdf564553"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af5e9da7ca3e17ddb3f5a07"},{"report_type":"sandbox","report_id":"5b07c92c7ca3e15b4d768173"},{"report_type":"sandbox","report_id":"610af264599342344248db98"},{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3064:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"Local\\SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"SM0:3064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]},{"name":"SM0:3064:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6440fb63c457609c090b406d"}]}]}},"report_ids":{"sandbox_job_ids":["5bb4aa9b7ca3e15cdf564553","5af5e9da7ca3e17ddb3f5a07","6440fb63c457609c090b406d","610af264599342344248db98","5b07c92c7ca3e15b4d768173"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Application.Hacktool Sample 99130c7385df… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 99130c7385df…. Malware family: Application.Hacktool. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9"}],["$","meta","4",{"property":"og:title","content":"Malicious Application.Hacktool Sample 99130c7385df… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 99130c7385df…. Malware family: Application.Hacktool. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/99130c7385dfa35d791c21c678d1bafc009284b345261eebfeacc3baf11b1bc9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Application.Hacktool Sample 99130c7385df… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 99130c7385df…. Malware family: Application.Hacktool. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]