26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 9b985f2af040… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9b985f2af040…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 13/25 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e"],"about":{"@type":"SoftwareApplication","name":"66ebf725efe38_lyla.exe","applicationCategory":["peexe","executable"],"identifier":"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":14,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8b4,Observed browser extension: "klnaejjgbibmhlephnhpmaofohgkpgkd" which is related to ZilPay [Source: sample.bin], Observed browser extension: "fhmfendgdocmcbmfikdcogofphimnkno" which is related to Sollet [Source: sample.bin], Observed browser extension: "ffnbelfdoeiohenkjibnmadjiehjhajb" which is related to Yoroi [Source: sample.bin], Observed browser extension: "efbglgofoippbgcjepnhiblaibcnclgk" which is related to Martian Wallet for Sui & Aptos [Source: sample.bin], Observed browser extension: "egjidjbpglichdcondbcbdnbeeppgdph" which is related to Trust Wallet [Source: sample.bin], Observed browser extension: "nkbihfbeogaeaoehlefnkodbefgpgknn" which is related to MetaMask [Source: sample.bin], Observed browser extension: "ibnejdfjmmkpcnlpebklmnkoeoihofec" which is related to TronLink [Source: sample.bin], Observed browser extension: "fhbohimaelbohpjbbldcngcnapndodjp" which is related to Binance Chain Wallet [Source: sample.bin], Observed browser extension: "acmacodkjbdgmoleebolmdjonilkdbch" which is related to Rabby Wallet [Source: sample.bin], Observed browser extension: "afbcbjpbpfadlkmhmclhkeeodmamcflc" which is related to Math Wallet [Source: sample.bin], Observed browser extension: "nlbmnnijcnlegkjjpcfjclmcfggfefdm" which is related to MEW CX [Source: sample.bin], Observed browser extension: "dmkamcknogkgcdfhhbddcghachkejeap" which is related to Keplr [Source: sample.bin], Observed browser extension: "fhilaheimglignddkjgofkcbgekhenbh" which is related to Oxygen [Source: sample.bin], Observed browser extension: "hpglfhgfnhbgpjdenjgmdgoeiappafln" which is related to Guarda [Source: sample.bin], Observed browser extension: "cjelfplplebdjjenllpjcblmjkfcffne" which is related to Jaxx Liberty [Source: sample.bin], Observed browser extension: "cbfnaelmomeimhlpmgjnjophhpkkoljpa" which is related to Phantom [Source: sample.bin], Observed browser extension: "fnjhmkhhmkbjkkabndcnnogagogbneec" which is related to Ronin Wallet [Source: sample.bin], Observed browser extension: "ookjlbkiijinhpmnjffcofjonbfbgaoc" which is related to Temple [Source: sample.bin], Observed browser extension: "aholpfdialjgjfhomihkjbmgjidlcdno" which is related to Exodus Web3 Wallet [Source: sample.bin]28:Tb9e,Found string "klnaejjgbibmhlephnhpmaofohgkpgkd" (Indicator: "klnaejjgbibmhlephnhpmaofohgkpgkd"; Source: "sample.bin"), Found string "idnnbdplmphpflfnlkomgpfbpcgelopg" (Indicator: "idnnbdplmphpflfnlkomgpfbpcgelopg"; Source: "sample.bin"), Found string "ejbalbakoplchlghecdalmeeeajnimhm" (Indicator: "ejbalbakoplchlghecdalmeeeajnimhm"; Source: "sample.bin"), Found string "fhmfendgdocmcbmfikdcogofphimnkno" (Indicator: "fhmfendgdocmcbmfikdcogofphimnkno"; Source: "sample.bin"), Found string "ffnbelfdoeiohenkjibnmadjiehjhajb" (Indicator: "ffnbelfdoeiohenkjibnmadjiehjhajb"; Source: "sample.bin"), Found string "Lbhhhlbepdkbapadjdnnojkbgioiodbic" (Indicator: "bhhhlbepdkbapadjdnnojkbgioiodbic"; Source: "sample.bin"), Found string "nkbihfbeogaeaoehlefnkodbefgpgknn" (Indicator: "nkbihfbeogaeaoehlefnkodbefgpgknn"; Source: "sample.bin"), Found string "ibnejdfjmmkpcnlpebklmnkoeoihofec" (Indicator: "ibnejdfjmmkpcnlpebklmnkoeoihofec"; Source: "sample.bin"), Found string "dlcobpjiigpikoobohmabehhmhfoodbb" (Indicator: "dlcobpjiigpikoobohmabehhmhfoodbb"; Source: "sample.bin"), Found string "kkpllkodjeloidieedojogacfhpaihoh" (Indicator: "kkpllkodjeloidieedojogacfhpaihoh"; Source: "sample.bin"), Found string "fhbohimaelbohpjbbldcngcnapndodjp" (Indicator: "fhbohimaelbohpjbbldcngcnapndodjp"; Source: "sample.bin"), Found string "lgmpcpglpngdoalbgeoldeajfclnhafa" (Indicator: "lgmpcpglpngdoalbgeoldeajfclnhafa"; Source: "sample.bin"), Found string "mcohilncbfahbmgdjkbpemcciiolgcge" (Indicator: "mcohilncbfahbmgdjkbpemcciiolgcge"; Source: "sample.bin"), Found string "omaabbefbmiijedngplfjmnooppbclkk" (Indicator: "omaabbefbmiijedngplfjmnooppbclkk"; Source: "sample.bin"), Found string "jnlgamecbpmbajjfhmmmlhejkemejdma" (Indicator: "jnlgamecbpmbajjfhmmmlhejkemejdma"; Source: "sample.bin"), Found string "afbcbjpbpfadlkmhmclhkeeodmamcflc" (Indicator: "afbcbjpbpfadlkmhmclhkeeodmamcflc"; Source: "sample.bin"), Found string "nlbmnnijcnlegkjjpcfjclmcfggfefdm" (Indicator: "nlbmnnijcnlegkjjpcfjclmcfggfefdm"; Source: "sample.bin"), Found string "dmkamcknogkgcdfhhbddcghachkejeap" (Indicator: "dmkamcknogkgcdfhhbddcghachkejeap"; Source: "sample.bin"), Found string "hpglfhgfnhbgpjdenjgmdgoeiappafln" (Indicator: "hpglfhgfnhbgpjdenjgmdgoeiappafln"; Source: "sample.bin"), Found string "cjelfplplebdjjenllpjcblmjkfcffne" (Indicator: "cjelfplplebdjjenllpjcblmjkfcffne"; Source: "sample.bin"), Found string "ppbibelpcjmhbdihakflkdcoccbgbkpo" (Indicator: "ppbibelpcjmhbdihakflkdcoccbgbkpo"; Source: "sample.bin"), Found string "hifafgmccdpekplomjjkcfgodnhcellj" (Indicator: "hifafgmccdpekplomjjkcfgodnhcellj"; Source: "sample.bin"), Found string "opcgpfmipidbgpenhmajoajpbobppdil" (Indicator: "opcgpfmipidbgpenhmajoajpbobppdil"; Source: "sample.bin"), Found string "fnjhmkhhmkbjkkabndcnnogagogbneec" (Indicator: "fnjhmkhhmkbjkkabndcnnogagogbneec"; Source: "sample.bin"), Found string "ookjlbkiijinhpmnjffcofjonbfbgaoc" (Indicator: "ookjlbkiijinhpmnjffcofjonbfbgaoc"; Source: "sample.bin")29:T6f0,Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin")2a:T488,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp")2b:T2098,"66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000008e0350059173000000002a005374fc864c742a005374fb8cda770000000000000000fc864c7440da5f010000000000000000000000002a00537409000000a0df8e0309000000fc864c740000000050059173180000000dcbc3c8a383d07150eb5e0100000000d8fc5f0140b1d071696c4eb8feffffff00da5f013a90cf71b0d95f0105400080000000005390cf712cda5f010000000000000000000000000000000000000000000000000100000000000000010000000000000028da5f010000000038da5f01000000002cda5f01000000000000000000000000a8db5f0035cbc3c840da5f0184da0f77ee0037bb44da5f01dab90f770000887338da5f01 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000050ce5f0138cfda77c4248b03bcce5f010100000078248b03c4248b0378248b03040000000400000000e01b7700100000bcce5f010100000078248b03cd97da779c97da773e0a37bbb50f127778248b030000da77000000003c14bc750000000080ee18770100000000000000f8e21b77000000000400000080a96f7448401a77f8e21b77c0ce5f0180e85b7658048c0380e85b76bcce5f010000000080e85b7664f607f1feffffff00000000000000000000000005000000e0d8571002000000020000000a000000d0d85710e0d8571000000000ee1362db40d15f01ddf30f7734cf5f0100000000d0d857100a000000f8f30f77d0d85710 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c0973c10d4973c10 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000008b0318ad930610898b0310898b037f070000c0008b0302000002cccd5f01d2fbd87701000000ff0700006b1d000018ad930600008b03000000000000000000008b038820591090205910fc1d000000000000005ef603eb2d00c66b1d00006b1d0000000092060000000000000000ca1537bbb072f6030000f603020000000300000300000000000000000000000002000002005ef60380d25f015cd25f0181f19377005ef60398d75f0128d45f01c5f1937700008b039834da77a89a930688d25f011c6090770400000080d25f015c835076f85df603a0909777000000003ccf5f0100000000 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009ed2b106b4d2b106 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000368357104e835710 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007eae930692ae9306 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000de8a5710f68a5710 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6d9b106ecd9b106 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e9a5710469a5710 (UID: 00000000-00004932)2c:T409,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "39865596576,372,114,,GetMonitorInfoA,user32.dll,"00:29:48.187",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00004932.00000001.115620.06995000.00000004.mdmp")2d:T8ad,"66ebf725efe38_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "66ebf725efe38_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}") "66ebf725efe38_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}"; Key: "DISPLAYNAME") "66ebf725efe38_lyla.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}"; Key: "DISPLAYVERSION") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "66ebf725efe38_lyla.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME")2e:T7cc,"66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004932) "service123.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006864) "service123.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006864) "service123.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006864) "service123.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006864) "service123.exe" called "LoadLibrary" with a parameter uQfmSSsJtzuLZuoqwBDR.dll (UID: 00000000-00006864)2f:T3e76,"66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter sprintf_s (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter swprintf_s (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter abs (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00004932) "66ebf725efe38_lyla.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004932) "service123.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter pbSkeRDbscdOhukRkRpU (UID: 00000000-00006864) "service123.exe" called "GetProcAddress" with a parameter ___lc_codepage_func (UID: 00000000-00006864)30:T10c8,"66ebf725efe38_lyla.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "66ebf725efe38_lyla.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "66ebf725efe38_lyla.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "66ebf725efe38_lyla.exe" loaded module "KERNEL32" at base 77220000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73400000 "66ebf725efe38_lyla.exe" loaded module "MSVCRT.DLL" at base 747f0000 "66ebf725efe38_lyla.exe" loaded module "KERNEL32.DLL" at base 77220000 "66ebf725efe38_lyla.exe" loaded module "WINHTTP.DLL" at base 732d0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 732b0000 "66ebf725efe38_lyla.exe" loaded module "RPCRT4.DLL" at base 74910000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73480000 "66ebf725efe38_lyla.exe" loaded module "SSPICLI.DLL" at base 74780000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73230000 "66ebf725efe38_lyla.exe" loaded module "NTDLL.DLL" at base 77d60000 "66ebf725efe38_lyla.exe" loaded module "ADVAPI32.DLL" at base 76a70000 "66ebf725efe38_lyla.exe" loaded module "USER32.DLL" at base 77b40000 "66ebf725efe38_lyla.exe" loaded module "GDIPLUS.DLL" at base 744c0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74230000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 744c0000 "66ebf725efe38_lyla.exe" loaded module "GDI32.DLL" at base 771f0000 "66ebf725efe38_lyla.exe" loaded module "OLE32.DLL" at base 76310000 "66ebf725efe38_lyla.exe" loaded module "WINDOWSCODECS.DLL" at base 73880000 "66ebf725efe38_lyla.exe" loaded module "CRYPT32.DLL" at base 77340000 "66ebf725efe38_lyla.exe" loaded module "SHELL32.DLL" at base 749d0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSWOW64\DLNASHEXT.DLL" at base 73130000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\PLAYTODEVICE.DLL" at base 730e0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\DEVDISPITEMPROVIDER.DLL" at base 730c0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 73060000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 72e80000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 764a0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72ba0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73cd0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72ad0000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 749d0000 "66ebf725efe38_lyla.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77220000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74070000 "66ebf725efe38_lyla.exe" loaded module "MSISO.DLL" at base 72a70000 "66ebf725efe38_lyla.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77010000 "66ebf725efe38_lyla.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 746d0000 "service123.exe" loaded module "KERNEL32" at base 77220000 "service123.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77010000 "service123.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77010000 "service123.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77010000 "service123.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77d20000 "service123.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77010000 "service123.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77010000 "service123.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77010000 "service123.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73400000 "service123.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 731f0000 "service123.exe" loaded module "KERNEL32.DLL" at base 77220000 "service123.exe" loaded module "UQFMSSSJTZULZUOQWBDR.DLL" at base 7324000031:T16ec,"66ebf725efe38_lyla.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}") "66ebf725efe38_lyla.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "DLNA Media Servers Data Source" (Path: "HKCU\WOW6432NODE\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Portable Devices" (Path: "HKCU\WOW6432NODE\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Portable Media Devices" (Path: "HKCU\WOW6432NODE\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\WOW6432NODE\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "66ebf725efe38_lyla.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "66ebf725efe38_lyla.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "66ebf725efe38_lyla.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "66ebf725efe38_lyla.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "66ebf725efe38_lyla.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "66ebf725efe38_lyla.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "66ebf725efe38_lyla.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "66ebf725efe38_lyla.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "66ebf725efe38_lyla.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "66ebf725efe38_lyla.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "66ebf725efe38_lyla.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")32:T855,"66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\1&8713BCA&0&UID0"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HTREE\ROOT\0"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\1&8713BCA&0&UID0\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\000A"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\1&8713BCA&0&UID0\PROPERTIES\{3B2CE006-5E61-4FDE-BAB8-9B8AAC9B26DF}\0008"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\1&8713BCA&0&UID0\PROPERTIES\{A35996AB-11CF-4935-8B61-A6761081ECDF}\000F"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\BASICDISPLAY\0000"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\BASICDISPLAY\0000\PROPERTIES\{3B2CE006-5E61-4FDE-BAB8-9B8AAC9B26DF}\0008"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\BASICDISPLAY\0000\PROPERTIES\{A35996AB-11CF-4935-8B61-A6761081ECDF}\000F"; Key: ""; Value: "") "66ebf725efe38_lyla.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\4&8B487E3&0&UID0"; Key: ""; Value: "")33:Tca4,"66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "")34:T8ee,"66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\login data" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\network\cookies" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\web data" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\local state" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\login data" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\network\cookies" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\web data" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\local state" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\cookies.sqlite" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\formhistory.sqlite" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\key4.db" "66ebf725efe38_lyla.exe" reads file "c:\users\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\music\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\links\desktop.ini" "66ebf725efe38_lyla.exe" reads file "c:\users\%osuser%\saved games\desktop.ini"35:T424,"66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\66ebf725efe38_lyla.exe" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\cfgmgr32.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\bcryptprimitives.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "66ebf725efe38_lyla.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll"36:T77e,"66ebf725efe38_lyla.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\FLTLIB.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\WINHTTP.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\winhttp.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\WEBIO.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\webio.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\winnlsres.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\WINDOWSCODECS.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\WindowsCodecs.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\DPAPI.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\DPAPI.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\CLDAPI.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\CLDAPI.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\AEPIC.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\AEPIC.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\BCRYPT.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\bcrypt.dll" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\PROPSYS.DLL" "66ebf725efe38_lyla.exe" trying to access non-existent file "C:\PROPSYS.dll"37:T2727,"66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "38dda30" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3906740" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3910d80" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "391f478" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3928018" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "38f19a0" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "38f2210" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "393bea8" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3941d08" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "394a1b0" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3947ea0" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "395b608" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3960e80" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "393a660" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "396c720" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3976d70" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "397fb18" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a3a80" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a4908" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a4bf0" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a3d68" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a4ed8" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a54a8" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a51c0" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"} "66ebf725efe38_lyla.exe" called "WinHttpSendRequest" with parameters {"hRequest": "39a4050" "lpszHeaders": "Content-Length: 411" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary61190838Content-Disposition: form-data; name=\"file\"; filename=\"Temedup.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "411" "dwTotalLength": "411" "dwContext": "0" "$error": "2ee7"}38:T1606,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004932-00000C29-781294635") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004932-00000C29-781327072") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004932-00000C29-781327204") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004932-00000C29-781327204") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004932-00000C29-781327204") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004932-00000C29-781327459") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004932-00000C29-781327459") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadData"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetReadFileExA" (Indicator: "InternetReadFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp")39:T583,Found reference to API "URLDownloadToFileA" (Indicator: "URLDownloadToFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "URLDownloadToFileA" (Indicator: "URLDownload"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetReadFileExA" (Indicator: "InternetReadFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "InternetReadFileExW" (Indicator: "InternetReadFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp")3a:Tbe4,Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadData"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadDataEx"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp")3b:T764e,Found URL "http://tventyvd20vt.top/v1/upload.phphttp://tveoptventyvd20vt.toprpc-160662c073087bf516device\afd\endpointrpc-160662c073087bf516rpc-160662c073087bf516tlm" - Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp") Found URL "http://tventyvd20vt.top/tventyvd20vt.topcpiphttp://tvev1/upload.phpttings\connectionsupload.phptventyvd20vt.topv1/upload.phptventyvd20vt.toptventyvd20vt.topv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpt.top/v1/upload.phpttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.toptventyvd20vt.totventyvd20vt.top:\windows\system32\jsproxy.dll:\windows\system32\jsproxy.dllv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phptventyvd20vt.toptventyvd20vt.topytventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.topttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/http://tventyvd20vt.top/tventyvd20vt.topnsresolver%2" - Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp") Found URL "https://update-ledger.net/update'" - Source: "00000000-00004932.00000001.115620.00881000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004932.00000001.115620.038B0000.00000004.mdmp") Found URL "http://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.php,ker%3=fgg4s004shg4s004shg4s004spg4s004spg4s004sxg4s004sg4s004sg4s004sg4s004sxg4s004s@g4s004sg4s004sg4s004s0g4s004sp+-s" - Source: "00000000-00004932.00000001.115620.066BA000.00000004.mdmp") Found URL "http://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phptpovhttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phptpovhttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.php0s@70sp30s890sh50s02cmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrcmgrhreqaaaat*%shreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaahreqaaaa%spqmozilla/5.0" - Source: "00000000-00004932.00000001.115620.066BA000.00000004.mdmp") Found URL "http://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.php)\http://tventyvd20vt.top/v1/upload.phptventyvd20vt.top/v1ad.phphttp://tventyvd20vt.top/v1/upload.phpttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phpttp://tventyvd20vt.top/v1/upload.phpfiles\ywzu7870.default\datareporting\archived\2019-01\*c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\ventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topr\siventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.top0.default\cookies.sventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topoloki_.tm.bcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrcojrdnsctimrdnsctimrpdnsctimrdnsctimrdnsctimrpdnsctimrdnsctimr%s(&dnsctimr%sp,dnsctimrdnsctimrdnsctimrp%sh?dnsctimrpdnsctimrdnsctimr(%s" - Source: "00000000-00004932.00000001.115620.06920000.00000004.mdmp") Found URL "http://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phptpovhttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phppragmano-cachepostpost" - Source: "00000000-00004932.00000001.115620.06920000.00000004.mdmp") Found URL "http://tventyvd20vt.top/tventyvd20vt.topv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpv1/upload.phpttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ttp://tventyvd20vt.top/ventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.toprotected_storageventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.toptventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.topventyvd20vt.top:\users\hapubws\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\key4.dbemgrtimr" - Source: "00000000-00004932.00000001.115620.06995000.00000004.mdmp") Found URL "http://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.phphttp://tventyvd20vt.top/v1/upload.php%3" (Indicator: "GetDC"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006864.00000000.121705.034C0000.00000004.mdmp")3e:T7b2,Found reference to API "FindFirstFileNameA" (Indicator: "FindFirstFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindFirstFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindNextFileNameA" (Indicator: "FindNextFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindNextFileNameW" (Indicator: "FindNextFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp")3f:T61a,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp")40:Tca4,"66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "66ebf725efe38_lyla.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "")41:T548,"66ebf725efe38_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "66ebf725efe38_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "66ebf725efe38_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#") "66ebf725efe38_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#") "66ebf725efe38_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\#") "66ebf725efe38_lyla.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#")42:Ta3e,"66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "66ebf725efe38_lyla.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data" "66ebf725efe38_lyla.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State" "66ebf725efe38_lyla.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "66ebf725efe38_lyla.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "66ebf725efe38_lyla.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db"43:T6e5,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003532.00000001.85320.00221000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp")44:T816,Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00003020.00000000.90683.0006C000.00000004.mdmp, 00000000-00004484.00000000.89910.0006C000.00000004.mdmp, 00000000-00004484.00000000.89910.64BF0000.00000004.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003020.00000000.90683.0006C000.00000004.mdmp, 00000000-00004484.00000000.89910.0006C000.00000004.mdmp, 00000000-00004484.00000000.89910.64BF0000.00000004.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00003020.00000000.90683.0006C000.00000004.mdmp, 00000000-00004484.00000000.89910.0006C000.00000004.mdmp, 00000000-00004484.00000000.89910.64BF0000.00000004.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00005640.00000002.84617.021F0000.00000004.mdmp, 00000000-00005640.00000003.89731.021F0000.00000004.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00005640.00000002.84617.021F0000.00000004.mdmp, 00000000-00005640.00000003.89731.021F0000.00000004.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00005640.00000002.84617.021F0000.00000004.mdmp, 00000000-00005640.00000003.89731.021F0000.00000004.mdmp")45:T7590,Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1235069; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1237043; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1240785; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1248569; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1249843; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1251893; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1252835; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1254011; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1254863; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1257191; code bytes = 30d0 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1230061; code bytes = 33c1 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1238727; code bytes = 33c1 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1241959; code bytes = 33c1 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1262179; code bytes = 33c1 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1234504; code bytes = 8030 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1246552; code bytes = 8030 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1249804; code bytes = 8030 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1250364; code bytes = 8030 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1251854; code bytes = 8030 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1252816; code bytes = 8030 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1253972; code bytes = 8030 Found XOR loop in file "uQfmSSsJtzuLZuoqwBDR.dll" at offset 1257156; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9D1B68.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A9D1B68.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9D1B68.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9D1B68.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1152903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1611655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1879623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2401159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3188135; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3448263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3907015; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5000149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5008779; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5010997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5019257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5027517; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5036957; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5045217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5057781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5066041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5074301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5082561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5090821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5099081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5107341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5115601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5123861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5132121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5140381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5148641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5156901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5165161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5173421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5181681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5189941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5198201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5206461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5214721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5224161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5232421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5240681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5248941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5257201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5265461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5273721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5281981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5290241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5298501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5306761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5315021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5323281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5331541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5339801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5348061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5356321; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5364581; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5372841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5381101; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5389361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5398801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5407061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5415321; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5423581; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5431841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5440101; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5448361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5456621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5464881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5473141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5481401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5489661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5497921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5506181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5514441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5522701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5530961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5539221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5547481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5555741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5565181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5573441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5581701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5589961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5598221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5606481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5614741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5623001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5631261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5639521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5647781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5656041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5664301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5672561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5680821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5689081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5697341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5705601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5713861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5722121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5730381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5731561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5739821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5748081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5756341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5764601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5772861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5781121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5789381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5797641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5805901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5814161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5822421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5830681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5838941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5847201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5855461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5863721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5871981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5880241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5888501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5896761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5915147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5917037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5920111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5991687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5995572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6011594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6115324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1126044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1584796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1852764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2374300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3161276; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3421404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3880156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5014753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5023013; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5031273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5040713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5053277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5069797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5078057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5086317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5094577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5102837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5111097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5119357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5127617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5135877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5144137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5152397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5160657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5168917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5177177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5185437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5193697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5201957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5210217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5218477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5227917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5236177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5244437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5252697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5260957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5269217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5277477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5285737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5293997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5302257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5310517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5318777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5327037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5335297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5343557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5351817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5360077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5368337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5376597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5384857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5394297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5402557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5410817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5419077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5427337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5435597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5443857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5452117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5460377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5468637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5476897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5485157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5493417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5501677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5509937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5518197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5526457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5534717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5542977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5551237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5559497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5568937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5577197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5585457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5593717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5601977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5610237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5618497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5626757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5635017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5643277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5651537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5659797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5668057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5676317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5684577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5692837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5701097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5709357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5717617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5725877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5735317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5743577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5751837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5760097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5768357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5776617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5784877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5793137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5801397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5809657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5817917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5826177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5834437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5842697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5850957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5859217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5867477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5875737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5883997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5892257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5901459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5901701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 98980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 104372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 139650; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 235384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 455066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 548162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1325495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2052215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2573751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2901975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3360727; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3620855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4130855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4165973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4237835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4252287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4304549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4527100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4527225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4571765; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4996076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4998400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5005740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5014516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5022776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5031036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5040476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5053040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5061300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5069560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5077820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5086080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5094340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5102600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5110860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5119120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5127380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5135640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5143900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5152160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5160420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5168680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5176940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5185200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5193460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5201720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5209980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5218240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5227680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5235940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5244200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5252460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5260720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5268980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5277240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5285500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5293760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5302020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5310280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5318540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5326800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5335060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5343320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5351580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5359840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5368100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5376360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5384620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5394060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5402320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5410580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5418840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5427100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5435360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5443620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5451880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5460140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5468400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5476660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5484920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5493180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5501440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5509700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5517960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5526220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5534480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5542740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5551000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5559260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5568700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5576960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5585220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5593480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5601740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5610000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5618260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5626520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5634780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5643040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5651300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5659560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5664237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5667820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5676080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5684340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5692600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5700860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5709120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5717380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5725640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5735080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5743340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5751600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5759860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5768120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5776380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5784640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5792900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5801160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5809420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5817680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5825940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5834200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5842460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5850720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5858980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5867240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5875500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5883760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5892020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5907548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5913234; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5915116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5917004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5919190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5920072; code bytes = 803046:T40e,Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp")47:T41d,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003532.00000001.85320.00221000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp")48:T61c,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp")49:T699,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003532.00000001.85320.00221000.00000020.mdmp "Opera Software\Opera Next" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "Opera Software\Opera Stable" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "Opera Software\Opera Crypto Stable" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "BraveSoftware\" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "Opera Software\Opera Developer" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "\Opera Software\" in Source: 00000000-00005640.00000000.80772.00881000.00000002.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005640.00000003.89731.0C960000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005640.00000003.89731.0C960000.00000004.mdmp4a:T5c7,Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004484.00000000.89910.00A30000.00000002.mdmp, 00000000-00004484.00000001.91831.00A30000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005640.00000000.80772.01530000.00000002.mdmp, 00000000-00005640.00000001.82694.01530000.00000002.mdmp, 00000000-00005640.00000002.84617.01530000.00000002.mdmp")4b:T5a3,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003532.00000000.83397.003E0000.00000004.mdmp, 00000000-00003532.00000001.85320.003E0000.00000004.mdmp, 00000000-00003532.00000002.87244.003E0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005640.00000000.80772.01250000.00000004.mdmp, 00000000-00005640.00000001.82694.01250000.00000004.mdmp, 00000000-00005640.00000002.84617.01250000.00000004.mdmp, 00000000-00005640.00000003.89731.01250000.00000004.mdmp") Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00005640.00000000.80772.01250000.00000004.mdmp, 00000000-00005640.00000001.82694.01250000.00000004.mdmp, 00000000-00005640.00000002.84617.01250000.00000004.mdmp, 00000000-00005640.00000003.89731.01250000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005640.00000000.80772.01250000.00000004.mdmp, 00000000-00005640.00000001.82694.01250000.00000004.mdmp, 00000000-00005640.00000002.84617.01250000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00005640.00000000.80772.01250000.00000004.mdmp, 00000000-00005640.00000001.82694.01250000.00000004.mdmp, 00000000-00005640.00000002.84617.01250000.00000004.mdmp") Found string "crosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005640.00000003.89731.01250000.00000004.mdmp")4c:T5ce,Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp")4d:T89c,Found registry query API: "RegOpenKeyExW" in file "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e" Found registry query API: "RegQueryValueExW" in file "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e" Found registry query API: "RegQueryValueExW" in "00000000-00003532.00000001.85320.00221000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003532.00000001.85320.00221000.00000020.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp"4e:T40a,Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp")4f:Tb28,"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindFirstFileW" with parameter %USERPROFILE%\* (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter AppData (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\* (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter Local (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\* (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter Adobe (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter AJCUuPPLSk (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\AJCUuPPLSk\* (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter Application Data (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter CEF (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\CEF\* (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter User Data (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\CEF\User Data\* (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter Dictionaries (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter ElevatedDiagnostics (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter GDIPFONTCACHEV1.DAT (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindNextFileW" with parameter Google (UID: 00000000-00005640) "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\* (UID: 00000000-00005640)50:Tf00,Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "CopySid" (Indicator: "CopySid"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "AddAce" (Indicator: "AddAce"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003532.00000001.85320.00221000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003532.00000001.85320.00221000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003532.00000001.85320.00221000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003532.00000001.85320.00221000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003532.00000001.85320.00221000.00000020.mdmp")51:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A9D1B68.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A9D1B68.bin]1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790895617117,"unified_at":"2026-10-01T23:00:17.117Z","metadata":{"hashes":{"sha256":"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","sha1":"a9db5e8f4e79d5e099a1e2a6d894d6d6d9283d03","md5":"117cd56896073eaa680d408fe7fb51c8","sha512":"c9854c250b669078f5095ed6093568db33f2b93e0eaa96e8e7bf97dee4e48374943b68cbfb7dd513c520b4ebf980b390eb7fc372bb59f69bc08f19ed7614f8a4","ssdeep":"49152:KfuaMm44Xnz/IYkmjVcIhGWczrYfRX9Iu14k85M7xgc6jbb36ST9llys58JLNQuC:WzRkmELkpX9RFXEb36Y9l9201LcDS","ssdeep_chunks":["49152:KfuaMm4","49152:fuaMm44","49152:uaMm44X","49152:aMm44Xn","49152:Mm44Xnz","49152:m44Xnz/","49152:44Xnz/I","49152:4Xnz/IY","49152:Xnz/IYk","49152:nz/IYkm","49152:z/IYkmj","49152:/IYkmjV","49152:IYkmjVc","49152:YkmjVcI","49152:kmjVcIh","49152:mjVcIhG","49152:jVcIhGW","49152:VcIhGWc","49152:cIhGWcz","49152:IhGWczr","49152:hGWczrY","49152:GWczrYf","49152:WczrYfR","49152:czrYfRX","49152:zrYfRX9","49152:rYfRX9I","49152:YfRX9Iu","49152:fRX9Iu1","49152:RX9Iu14","49152:X9Iu14k","49152:9Iu14k8","49152:Iu14k85","49152:u14k85M","49152:14k85M7","49152:4k85M7x","49152:k85M7xg","49152:85M7xgc","49152:5M7xgc6","49152:M7xgc6j","49152:7xgc6jb","49152:xgc6jbb","49152:gc6jbb3","49152:c6jbb36","49152:6jbb36S","49152:jbb36ST","49152:bb36ST9","49152:b36ST9l","49152:36ST9ll","49152:6ST9lly","49152:ST9llys","49152:T9llys5","49152:9llys58","49152:llys58J","49152:lys58JL","49152:ys58JLN","49152:s58JLNQ","49152:58JLNQu","49152:8JLNQuC","98304:KfuaMm4","98304:fuaMm44","98304:uaMm44X","98304:aMm44Xn","98304:Mm44Xnz","98304:m44Xnz/","98304:44Xnz/I","98304:4Xnz/IY","98304:Xnz/IYk","98304:nz/IYkm","98304:z/IYkmj","98304:/IYkmjV","98304:IYkmjVc","98304:YkmjVcI","98304:kmjVcIh","98304:mjVcIhG","98304:jVcIhGW","98304:VcIhGWc","98304:cIhGWcz","98304:IhGWczr","98304:hGWczrY","98304:GWczrYf","98304:WczrYfR","98304:czrYfRX","98304:zrYfRX9","98304:rYfRX9I","98304:YfRX9Iu","98304:fRX9Iu1","98304:RX9Iu14","98304:X9Iu14k","98304:9Iu14k8","98304:Iu14k85","98304:u14k85M","98304:14k85M7","98304:4k85M7x","98304:k85M7xg","98304:85M7xgc","98304:5M7xgc6","98304:M7xgc6j","98304:7xgc6jb","98304:xgc6jbb","98304:gc6jbb3","98304:c6jbb36","98304:6jbb36S","98304:jbb36ST","98304:bb36ST9","98304:b36ST9l","98304:36ST9ll","98304:6ST9lly","98304:ST9llys","98304:T9llys5","98304:9llys58","98304:llys58J","98304:lys58JL","98304:ys58JLN","98304:s58JLNQ","98304:58JLNQu","98304:8JLNQuC","49152:WzRkmEL","49152:zRkmELk","49152:RkmELkp","49152:kmELkpX","49152:mELkpX9","49152:ELkpX9R","49152:LkpX9RF","49152:kpX9RFX","49152:pX9RFXE","49152:X9RFXEb","49152:9RFXEb3","49152:RFXEb36","49152:FXEb36Y","49152:XEb36Y9","49152:Eb36Y9l","49152:b36Y9l9","49152:36Y9l92","49152:6Y9l920","49152:Y9l9201","49152:9l9201L","49152:l9201Lc","49152:9201LcD","49152:201LcDS"],"imphash":"92a00f4d0a4448266e9c638fdb1341b9"},"file_info":{"file_name":"66ebf725efe38_lyla.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6630801,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1726662030000,"last_seen":1788671566000,"last_multi_scan":1788671566000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cryptocurrencytheft","evasive","cryptbot/v3","credentialharvesting","criminal","informationstealer","cryptbot","downloader","infostealer"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":4,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":222,"suspicious_count":26,"malicious_count":14,"total":262},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.CryptBot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/Win32.Wacapew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Tedy.35902","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/PSW.Agent.OGR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 0054cf561 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.JHH.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WKT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Cryptnot.Win32.975","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"CryptoCurrencyTheft","sources":[{"report_type":"qsp","report_id":""}]},{"value":"CryptBot","sources":[{"report_type":"qsp","report_id":""}]},{"value":"CryptBot/V3","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using web history"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to retrieve browser history information"},{"type":"suspicious","value":"Able to access crypto wallet extension (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"suspicious","value":"References password manager extension ID(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Chromium browser credentials files"},{"type":"informative","value":"References Firefox browser credentials files"},{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"malicious","value":"Reads the registry for VMWare specific artifacts"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Tries to steal crypto wallet extension (string)"},{"type":"suspicious","value":"Found Crypto currency wallets related strings"},{"type":"suspicious","value":"Found browsers sensitive information related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Uses Windows cryptography API for obfuscation"},{"type":"suspicious","value":"YARA signature match – SDBM hashing algorithm"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"References password manager extension ID(s)","description":"Found string \"gaedmjdfmmahhbjefcbgaolhhanlaolb\" (Source: \"sample.bin\"), Found string \"imloifkgjagghnncjkhggdhalmcnfklk\" (Source: \"sample.bin\"), Found string \"nngceckbapebfimnlniiiahkandclblb\" (Source: \"sample.bin\"), Found string \"bhghoamapcdpbohphigoooaddinpkbai\" (Source: \"sample.bin\"), Found string \"hdokiejnpimakedhajhdlcegeplioahd\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.005","id":"string-641","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (string)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-125","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to access crypto wallet extension (string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10066","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser history information","description":"Found string \"formhistory.sqlite\" (Indicator: \"formhistory.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10069","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found Crypto currency wallets related strings","description":"Observed string: \"\\ElectronCash\\wallets\" (Indicator: \"\\electroncash\\wallets\") in Source: sample.bin, Observed string: \"\\Electrum\\wallets\" (Indicator: \"\\electrum\\wallets\") in Source: sample.bin, Observed string: \"\\Electrum-btcp\\wallets\" (Indicator: \"\\electrum-btcp\\wallets\") in Source: sample.bin, Observed string: \"\\Exodus\\backup\" (Indicator: \"\\exodus\\backup\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-100","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"GetProcAddress@8\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key3.db\" (Indicator: \"key3.db\"; in Source: \"sample.bin\"), Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\"), Found reference to API \"K_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\"), Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"atomic\\Local Storage\\leveldb\" in Source: sample.bin, \"Authy Desktop\\Local Storage\\leveldb\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-133","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-311","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Opera Software\\Opera GX Stable\" in Source: sample.bin, \"Opera Software\\Opera Next\" in Source: sample.bin, \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: sample.bin, \"Opera Software\\Opera Developer\" in Source: sample.bin, \"Opera Software\\Opera Crypto Stable\" in Source: sample.bin, \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: sample.bin, \"5BraveSoftware\\\" in Source: sample.bin, \"\\Opera Software\\\" in Source: sample.bin, \"SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\" in Source: sample.bin, \"Opera Software\\Opera Stable\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"SUPERAntiSpyware\" (Indicator: \"superantispyware\") in Source: sample.bin, \"Tencent\" (Indicator: \"tencent\") in Source: sample.bin, \"McAfee_Inc\" (Indicator: \"mcafee\") in Source: sample.bin, \"Lavasoft\" (Indicator: \"lavasoft\") in Source: sample.bin, \"Avira\" (Indicator: \"avira\") in Source: sample.bin, \"kingsoft\" (Indicator: \"kingsoft\") in Source: sample.bin, \"Baidu\" (Indicator: \"baidu\") in Source: sample.bin, \"McAfee\" (Indicator: \"mcafee\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Expression\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-288","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"#GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \":GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"paint.net\", Heuristic match: \"4kdownload.com\", Pattern match: \"https://update-ledger.net/update\", Heuristic match: \"battle.net\", Heuristic match: \"asp.net\", Heuristic match: \"wargaming.net\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Type: multipart/form-data; boundary=----Boundary%lu\"; Source: \"sample.bin\"), Found string \"------Boundary%lu\nContent-Disposition: form-data; name=\"file\"; filename=\"%s.bin\"\nContent-Type: application/octet-stream\n\n\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-511","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-282","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://update\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"formhistory.sqlite\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-662","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\"), Found reference to API \" LGetStartupInfoA@4\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"f\nMSetUnhandledExceptionFilter@4\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"f\nMSetUnhandledExceptionFilter@4\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"before addCryptoWallets\" (Source: sample.bin, Indicator: \"cryptowall\")","origin":"sample.bin","mitre_attack_id":"T1491.001","id":"string-13","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006864.00000000.121705.73370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006864.00000000.121705.034C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RC2;\" (Indicator: \"RC2\"; Source: \"00000000-00004932.00000001.115620.00B9B000.00000004.mdmp, 00000000-00004932.00000002.117539.05BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004932.00000002.117539.05C1F000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 60816-11-004014B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ebx\n 01h in Stream UID: 60816-11-004014B0\n Assembly shows XOR instruction xor ebx\n 1Fh in Stream UID: 00000000-00006864-379-11-002F64EC\n Assembly shows XOR instruction xor ebx\n 01h in Stream UID: 00000000-00006864-379-43-002F117C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Tries to steal crypto wallet extension (string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Calls an API typically used to decrypt the data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"66ebf725efe38_lyla.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"66ebf725efe38_lyla.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"service123.exe\" called \"OpenMutexA\" with parameter \"hmzjNwggTSDZuULnANqH\" - (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"66ebf725efe38_lyla.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"service123.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"39863115228,372,3024,,RtlGetVersion,NTDLL.dll,\"0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004932.00000001.115620.06995000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"service123.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"66ebf725efe38_lyla.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\AJCUuPPLSk (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"66ebf725efe38_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\service123.exe\"\" - (UID: 00000000-00004932)\n \"66ebf725efe38_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" - (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 66ebf725efe38_lyla.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"66ebf725efe38_lyla.exe\" contains export function called \"main\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:4932:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:4932:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:4932:64:WilError_01\"\n \"hmzjNwggTSDZuULnANqH\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; File: \"66ebf725efe38_lyla.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"66ebf725efe38_lyla.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 762B0000\n \"66ebf725efe38_lyla.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73550000\n \"service123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 762B0000\n \"service123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73550000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 762B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"66ebf725efe38_lyla.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74910000\n \"service123.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74910000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74910000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"66ebf725efe38_lyla.exe\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$31","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"66ebf725efe38_lyla.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"66ebf725efe38_lyla.exe\" has an writable section named \".data\"\n \"66ebf725efe38_lyla.exe\" has an writable section named \".bss\"\n \"66ebf725efe38_lyla.exe\" has an writable section named \".idata\"\n \"66ebf725efe38_lyla.exe\" has an writable section named \".CRT\"\n \"66ebf725efe38_lyla.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"66ebf725efe38_lyla.exe\" file has an entrypoint instructions - \"mov\tdword ptr [0xf3174c], 1,jmp\t0x401170,nop\t,mov\tdword ptr [0xf3174c], 0,jmp\t0x401170,nop\t,sub\tesp, 0x1c,mov\teax, dword ptr [esp + 0x20],mov\tdword ptr [esp], eax,call\t0x87d948,test\teax, eax,sete\tal,add\tesp, 0x1c,movzx\teax, al,neg\teax,ret\t,nop\t,nop\t,nop\t,push\tebp,mov\tebp, esp,push\tedi,push\tesi,push\tebx,sub\tesp, 0x1c,mov\tdword ptr [esp], 0x881000,call\tdword ptr [0xf341f0],sub\tesp, 4,test\teax, eax,je\t0x401580,mov\tebx, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x47d800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x47d7c4\" greater than 0x100000\n Virtual size of \".bss\" is \"0x66e254\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00004932-00000C44-301146656220]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" [Source: 00000000-00004932-00000C44-301146656220]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"service123.exe\" (UID: 00000000-00006864) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"service123.exe\" (UID: 00000000-00006864) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"service123.exe\" (UID: 00000000-00005292) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"service123.exe\" (UID: 00000000-00005292) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"tventyvd20vt.top\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"service123.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"service123.exe\" (UID: 00000000-00006864)\n Spawned process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00: ...\" (UID: 00000000-00006152)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"service123.exe\" (UID: 00000000-00006864)\n Spawned process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00: ...\" (UID: 00000000-00006152)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"66ebf725efe38_lyla.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"66ebf725efe38_lyla.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"66ebf725efe38_lyla.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"service123.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- [targetUID: N/A]\n \"uQfmSSsJtzuLZuoqwBDR.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\uQfmSSsJtzuLZuoqwBDR.dll]- [targetUID: 00000000-00004932]\n \"service123.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\service123.exe]- [targetUID: 00000000-00004932]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"66ebf725efe38_lyla.exe\" queries basic process information of the \"C:\\66ebf725efe38_lyla.exe\" (UID: 4932)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"66ebf725efe38_lyla.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"66ebf725efe38_lyla.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"66ebf725efe38_lyla.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"66ebf725efe38_lyla.exe\" trying to access non-existent file \"C:\\66EBF725EFE38_LYLA.EXE.LOCAL\"\n \"66ebf725efe38_lyla.exe\" trying to access non-existent file \"C:\\66ebf725efe38_lyla.exe.Local\\\"\n \"66ebf725efe38_lyla.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe:ZONE.IDENTIFIER\"\n \"66ebf725efe38_lyla.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe:Zone.Identifier\"\n \"66ebf725efe38_lyla.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\schtasks.exe:ZONE.IDENTIFIER\"\n \"66ebf725efe38_lyla.exe\" trying to access non-existent file \"C:\\Windows\\System32\\schtasks.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"66ebf725efe38_lyla.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\service123.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$37","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"66ebf725efe38_lyla.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"503384265\"\n \"cx\": \"1280\"\n \"cy\": \"800\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"66ebf725efe38_lyla.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"service123.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"66ebf725efe38_lyla.exe\" called \"GetComputerNameW\" (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"66ebf725efe38_lyla.exe\" called \"GetUserNameW\" (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00006864.00000000.121705.73370000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00006864.00000000.121705.73370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"39863115228,372,3024,,RtlGetVersion,NTDLL.dll,\"0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004932.00000001.115620.06995000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"66ebf725efe38_lyla.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"66ebf725efe38_lyla.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004932.00000000.113698.038B0000.00000004.mdmp, 00000000-00004932.00000001.115620.038B0000.00000004.mdmp, 00000000-00004932.00000002.117539.038B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"66ebf725efe38_lyla.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004932.00000000.113698.00F19000.00000004.mdmp, 00000000-00004932.00000002.117539.00F19000.00000004.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006864.00000000.121705.73370000.00000004.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00006864.00000000.121705.73370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"uQfmSSsJtzuLZuoqwBDR.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\uQfmSSsJtzuLZuoqwBDR.dll]- [targetUID: 00000000-00004932]\n \"service123.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\service123.exe]- [targetUID: 00000000-00004932]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"service123.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"66ebf725efe38_lyla.exe\" has section name .text with entropy \"6.27130877153\"\n \"66ebf725efe38_lyla.exe\" has section name .reloc with entropy \"6.84154801281\"\n \"66ebf725efe38_lyla.exe\" has section name /29 with entropy \"6.06174511088\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"66ebf725efe38_lyla.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 60816-11-004014B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"66ebf725efe38_lyla.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"service123.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- [targetUID: N/A]\n \"uQfmSSsJtzuLZuoqwBDR.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\uQfmSSsJtzuLZuoqwBDR.dll]- [targetUID: 00000000-00004932]\n \"service123.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\service123.exe]- [targetUID: 00000000-00004932]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"66ebf725efe38_lyla.exe\" wrote 40960 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"66ebf725efe38_lyla.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoA\n GetTempPathA\n LoadLibraryA\n GetModuleHandleA\n VirtualProtect\n Sleep\n GetProcAddress\n GetModuleHandleW\n ShellExecuteA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"66ebf725efe38_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\service123.exe\"\" - (UID: 00000000-00004932)\n \"66ebf725efe38_lyla.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" - (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the registry for VMWare specific artifacts","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-56","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"66ebf725efe38_lyla.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\/service123.exe (UID: 00000000-00004932)\n \"66ebf725efe38_lyla.exe\" called \"ShellExecuteA\" with parameter schtasks.exe (UID: 00000000-00004932)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73C40000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00:01 /du 9800:59 /sc once /ri 1 /f\" (UID: 00000000-00006152)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"66ebf725efe38_lyla.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\" (Handle: 1012)\n \"66ebf725efe38_lyla.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 968)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$42","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"decompression failed or archive is corrupted\" (Source: \"00000000-00005640.00000000.80772.00881000.00000002.mdmp\")\n Found string \"compression failed\" (Source: \"00000000-00005640.00000000.80772.00881000.00000002.mdmp\")\n Found string \"invalid compression level\" (Source: \"00000000-00005640.00000000.80772.00881000.00000002.mdmp\")\n Found string \"dd_dotnet48_decompression_log.txt\" (Source: \"00000000-00005640.00000003.89731.0C960000.00000004.mdmp\")\n Found string \"dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt\" (Source: \"00000000-00005640.00000003.89731.0C960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005640-00000C2C-293362071\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$44","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003020.00000000.90683.00330000.00000004.mdmp, 00000000-00003532.00000000.83397.003E0000.00000004.mdmp, 00000000-00003532.00000001.85320.003E0000.00000004.mdmp, 00000000-00003532.00000002.87244.003E0000.00000004.mdmp, 00000000-00003532.00000003.90498.00433000.00000004.mdmp, 00000000-00004484.00000000.89910.000B0000.00000004.mdmp, 00000000-00004484.00000001.91831.000B0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005640.00000000.80772.01250000.00000004.mdmp, 00000000-00005640.00000001.82694.01250000.00000004.mdmp, 00000000-00005640.00000002.84617.01250000.00000004.mdmp, 00000000-00005640.00000003.89731.01250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$45","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName (ComputerName):\" (Source: \"00000000-00005640.00000000.80772.00881000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"vboxguestadditions\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00005640.00000003.89731.0C960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005640-00000C2C-266374798\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003532.00000001.85320.00221000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003532.00000001.85320.00221000.00000020.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005640)\n \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005640)\n \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005640)\n \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005640)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005640)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"IsWow64Process\" with parameter \"5640\" - (UID: 00000000-00005640)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f00f00700000000008c47be73b0bfaa028c47be7300000000b0bfaa0200d82200086d2977188131770000000004dc2200000000000800000040d8220095e12577f2b70b00feffffff6b2c2a7731191b7502100000000000000000010014d82200c89f29778c47be730000000000000000 (UID: 00000000-00005640)\n \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005640)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A9D1B68.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003532.00000001.85320.00221000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003532.00000001.85320.00221000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 51842-3001-004014F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003532.00000001.85320.00221000.00000020.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003532.00000001.85320.00221000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005640.00000003.89731.0C960000.00000004.mdmp\n \":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005640.00000003.89731.0C960000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6A9D1B68.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DISMHOST.EXE.6A9D1B68.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"screenshots@mozilla.org\"\n Pattern match: \"k@48g9-.bybgnptut\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75D40000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f48c75@RPCRT4.dll\"\n \"1800190068e8a56a@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8a56a@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5fa56a@ntdll.dll\"\n \"0400050080cfd000@msvcrt.dll\"\n \"09000a008058d100@msvcrt.dll\"\n \"0a000b008059d100@msvcrt.dll\"\n \"150016002073ac6a@ADVAPI32.dll\"\n \"0e000f00e473ac6a@ADVAPI32.dll\"\n \"0e000f005074ac6a@ADVAPI32.dll\"\n \"11001200d47dac6a@ADVAPI32.dll\"\n \"110012007c7eac6a@ADVAPI32.dll\"\n \"12001300cc7eac6a@ADVAPI32.dll\"\n \"12001300387fac6a@ADVAPI32.dll\"\n \"14001500e4b7ac6a@ADVAPI32.dll\"\n \"1400150000b8ac6a@ADVAPI32.dll\"\n \"140015001cb8ac6a@ADVAPI32.dll\"\n \"1700180038b8ac6a@ADVAPI32.dll\"\n \"0d000e0054b8ac6a@ADVAPI32.dll\"\n \"1100120064b8ac6a@ADVAPI32.dll\"\n \"110012007cb8ac6a@ADVAPI32.dll\"\n \"0d000e009c7fac6a@SHELL32.dll\"\n \"0d000e002880ac6a@SHELL32.dll\"\n \"0f001000ecb9ac6a@ADVAPI32.dll\"\n \"1400150038baac6a@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6A9D1B68.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"uQfmSSsJtzuLZuoqwBDR.dll\" has high imagebase \"0x64880000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005640.00000003.89731.0C960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005640-00000C2B-279586265]\n Observed system executable string:\"%WINDIR%\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll\" [Source: 00000000-00005640-00000C2B-279946733]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"uQfmSSsJtzuLZuoqwBDR.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%TEMP%\\uQfmSSsJtzuLZuoqwBDR.dll]- [targetUID: 00000000-00005640]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping \"; Source: \"00000000-00003532.00000000.83397.003E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEF49DD864D28444288FBF9D9884F1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532.00000000.83397.003E0000.00000004.mdmp, 00000000-00003532.00000001.85320.003E0000.00000004.mdmp, 00000000-00003532.00000002.87244.003E0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEBCEEEAEAE2E54F0A853FE3A9B6B2]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532.00000001.85320.003E0000.00000004.mdmp, 00000000-00003532.00000002.87244.003E0000.00000004.mdmp, 00000000-00003532.00000003.90498.00433000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e\")\n Found string \"GetClipboardData\" (Source: \"00000000-00004484.00000000.89910.64BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found reference to API \"8283246,5888,3024,,RtlGetVersion,NTDLL.dll,\"252:14:25.796\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005640.00000003.89731.0C960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005640.00000000.80772.00F19000.00000004.mdmp, 00000000-00005640.00000001.82694.00F19000.00000004.mdmp, 00000000-00005640.00000003.89731.00F19000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" tries to directly access volume data \"C:\"\n \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Base64}\" (Indicator: \"base64\"; Source: \"00000000-00005640.00000001.82694.021F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003532.00000001.85320.00221000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping\"; Source: \"00000000-00003532.00000000.83397.003E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"Found string \"C:\\Users\\HAPUBWS\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; Source: \"00000000-00005640.00000001.82694.021F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$51","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DISMHOST.EXE.6A9D1B68.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"File has excessive sections (18)\n common in obfuscated files\n Section \".bss\" unusually large (6742612 bytes)\n possible junk padding\n Section \".edata\" has very low entropy (0.72)\n indicating potential NOP sled\n Section \".data\" has very low entropy (0.79)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"uQfmSSsJtzuLZuoqwBDR.dll\" has no resource directory\n \"service123.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003532.00000002.87244.003E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses Windows cryptography API for obfuscation","description":"Observed Cryptography api used in \"advapi32.dll\" [Source: uQfmSSsJtzuLZuoqwBDR.dll]\n Observed Cryptography api used in \"advapi32.dll\" [Source: service123.exe]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":3,"id":"static-207","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 51842-3001-004014F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/24 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – SDBM hashing algorithm","description":"YARA signature for SDBM hashing algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-223","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched process \"00000000-00005640\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store\" matched file \"sample.bin\" as \"Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers\"\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched file \"sample.bin\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\"\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs\" matched file \"sample.bin\" as \"Detect binaries embedding considerable number of MFA browser extension IDs.\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"uQfmSSsJtzuLZuoqwBDR.dll\" claimed CRC 6679247 while the actual is CRC 5290992\n \"service123.exe\" claimed CRC 1314800 while the actual is CRC 5263881\n \"DISMHOST.EXE.6A9D1B68.bin\" claimed CRC 66057 while the actual is CRC 103114","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/24 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/23 Antivirus vendors marked dropped file \"service123.exe\" as malicious (classified as \"Gen:Variant.Zusy\" with 47% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Reads the registry for VMWare specific artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]}],"intel_graph":{"map":{"Domain:tventyvd20vt.top":{"type":"Domain","value":"tventyvd20vt.top"},"File:1c2637303044e8141ff7998a6c8ebc1a775047834e5f827f8f73ac246aebd16f":{"type":"File","value":"1c2637303044e8141ff7998a6c8ebc1a775047834e5f827f8f73ac246aebd16f"},"File:3738a1759283d8bead087813b71fa4406ddbd10b1542199ac3acea27e43b13dd":{"type":"File","value":"3738a1759283d8bead087813b71fa4406ddbd10b1542199ac3acea27e43b13dd"},"File:421b342a624951292cf0cd83ecffa0318d7247aebcde9ca2230a4d657d36c425":{"type":"File","value":"421b342a624951292cf0cd83ecffa0318d7247aebcde9ca2230a4d657d36c425"},"File:99bbb3c711ed81fc58851d8efedbd88fa91041c7e135beb326abe29c11a30f8b":{"type":"File","value":"99bbb3c711ed81fc58851d8efedbd88fa91041c7e135beb326abe29c11a30f8b"},"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e":{"type":"File","value":"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat CryptBot","confirmed relationship with a Threat CryptBot/V3","confirmed relationship with a Threat CryptoCurrencyTheft"]}},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Threat:149065aa0da3bd1aa426a5f2903d1240e403d0c9662c47d609f37319d8e382ee":{"type":"Threat","value":"CryptBot","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:834edf0eafa2890b30e4cc553ae2a41484ec6f8ff5b940013e674ffcb813e882":{"type":"Threat","value":"CryptBot/V3","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:b38ec2072606e6d32755d8faaccf2f0976c1713e33dd5ecc497236f0be989a96":{"type":"Threat","value":"CryptoCurrencyTheft","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1546025360522723855","root":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat CryptBot","confirmed relationship with a Threat CryptBot/V3","confirmed relationship with a Threat CryptoCurrencyTheft"]}},{"id":"1546025354845615889","root":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","edges":[{"edge_kind":"is_threat","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"Threat:149065aa0da3bd1aa426a5f2903d1240e403d0c9662c47d609f37319d8e382ee"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1546025354845615890","root":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","edges":[{"edge_kind":"is_threat","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"Threat:834edf0eafa2890b30e4cc553ae2a41484ec6f8ff5b940013e674ffcb813e882"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1546025354849810195","root":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","edges":[{"edge_kind":"is_threat","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"Threat:b38ec2072606e6d32755d8faaccf2f0976c1713e33dd5ecc497236f0be989a96"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","edges":[{"edge_kind":"contacted_domain","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"Domain:tventyvd20vt.top"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","edges":[{"edge_kind":"extracted","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"File:421b342a624951292cf0cd83ecffa0318d7247aebcde9ca2230a4d657d36c425"},{"edge_kind":"extracted","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"File:99bbb3c711ed81fc58851d8efedbd88fa91041c7e135beb326abe29c11a30f8b"},{"edge_kind":"extracted","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"File:1c2637303044e8141ff7998a6c8ebc1a775047834e5f827f8f73ac246aebd16f"},{"edge_kind":"extracted","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","to_key":"File:3738a1759283d8bead087813b71fa4406ddbd10b1542199ac3acea27e43b13dd"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":121,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["cryptocurrencytheft","evasive","cryptbot/v3","credentialharvesting","criminal","informationstealer","cryptbot","downloader","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a9cf64cc9d6d6316e057a81","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W32.Evo","submit_name":"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","analysis_start_time":"2026-09-06T05:12:46+00:00","indicators_count":{"informative":181,"suspicious":42,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6708f8fb89b716f6d20d3eea","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":56,"submit_name":"66ebf725efe38_lyla.exe","analysis_start_time":"2024-10-11T10:07:55+00:00","indicators_count":{"informative":152,"suspicious":39,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"tventyvd20vt.top","country":"-","registrar_name":"NICENIC INTERNATIONAL GROUP CO., LIMITED","registrar_organization":"snucci","registrar_name_servers":"a.dnspod.com","registrar_creation_date":"2024-09-16T17:23:17+00:00","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}],"processes":[{"pid":4932,"ppid":0,"name":"66ebf725efe38_lyla.exe","command_line":"","sha256":"9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e","normalized_path":"C:\\66ebf725efe38_lyla.exe","uid":"00000000-00004932","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6864,"ppid":4932,"name":"service123.exe","command_line":"","sha256":"1c2637303044e8141ff7998a6c8ebc1a775047834e5f827f8f73ac246aebd16f","normalized_path":"%TEMP%\\service123.exe","parent_uid":"00000000-00004932","uid":"00000000-00006864"},{"pid":6152,"ppid":4932,"name":"schtasks.exe","command_line":"/create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01 /du 9800:59 /sc once /ri 1 /f","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00004932","uid":"00000000-00006152"},{"pid":5292,"ppid":0,"name":"service123.exe","command_line":"","sha256":"1c2637303044e8141ff7998a6c8ebc1a775047834e5f827f8f73ac246aebd16f","normalized_path":"%TEMP%\\service123.exe","uid":"00000000-00005292","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["wpdshext.dll","gdi32full.dll","crypt32.dll","msasn1.dll","DevDispItemProvider.dll","msIso.dll","xmllite.dll","imm32.dll","powrprof.dll","rasadhlp.dll","WindowsCodecs.dll","imagehlp.dll","apphelp.dll","ws2_32.dll","winhttp.dll","nsi.dll","GdiPlus.dll","MMDevAPI.dll","rsaenh.dll","SHCore.dll","oleaut32.dll","dlnashext.dll","rpcrt4.dll","kernel.appcore.dll","OnDemandConnRouteHelper.dll","winnsi.dll","ntdll.dll","cfgmgr32.dll","win32u.dll","VxSSL32.dll","cldapi.dll","aepic.dll","PlayToDevice.dll","cryptbase.dll","shlwapi.dll","msvcp_win.dll","edputil.dll","taskschd.dll","wow64win.dll","sechost.dll","ole32.dll","sspicli.dll","mswsock.dll","dnsapi.dll","urlmon.dll","IPHLPAPI.DLL","uxtheme.dll","dpapi.dll","OneCoreUAPCommonProxyStub.dll","iertutil.dll","wow64cpu.dll","advapi32.dll","msvcrt.dll","profapi.dll","ntmarta.dll","uQfmSSsJtzuLZuoqwBDR.dll","kernel32.dll","shell32.dll","gdi32.dll","cryptsp.dll","msctf.dll","devobj.dll","wow64.dll","ucrtbase.dll","bcryptprimitives.dll","combase.dll","windows.storage.dll","fltLib.dll","webio.dll","Windows.StateRepositoryPS.dll","user32.dll","KernelBase.dll","bcrypt.dll","propsys.dll","clbcatq.dll","api-ms-win-crt-heap-l1-1-0.dll","Wldap32.dll","api-ms-win-downlevel-version-l1-1-0.dll","normaliz.dll","wininet.dll","usp10.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","msvcp140.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","ieframe.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","WSHTCPIP.DLL","lpk.dll","comctl32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","wshqos.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","vcruntime140.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","secur32.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","tzres.dll","rpcss.dll","winmm.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","wship6.dll","shdocvw.dll","setupapi.dll","version.dll","credssp.dll","userenv.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"service123.exe","sha256":"421b342a624951292cf0cd83ecffa0318d7247aebcde9ca2230a4d657d36c425","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"name":"uQfmSSsJtzuLZuoqwBDR.dll","sha256":"99bbb3c711ed81fc58851d8efedbd88fa91041c7e135beb326abe29c11a30f8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"name":"service123.exe.bin","sha256":"1c2637303044e8141ff7998a6c8ebc1a775047834e5f827f8f73ac246aebd16f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"DISMHOST.EXE.6A9D1B68.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"name":"dism.log","sha256":"3738a1759283d8bead087813b71fa4406ddbd10b1542199ac3acea27e43b13dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]}],"files_written":[{"path":"%TEMP%\\service123.exe","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"path":"%TEMP%\\uQfmSSsJtzuLZuoqwBDR.dll","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"},{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:4932:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"Local\\SM0:4932:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"SM0:4932:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"hmzjNwggTSDZuULnANqH","sources":[{"report_type":"sandbox","report_id":"6708f8fb89b716f6d20d3eea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9cf64cc9d6d6316e057a81"}]}]}},"report_ids":{"sandbox_job_ids":["6a9cf64cc9d6d6316e057a81","6708f8fb89b716f6d20d3eea"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 9b985f2af040… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9b985f2af040…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 13/25 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 9b985f2af040… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9b985f2af040…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 13/25 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 9b985f2af040… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9b985f2af040…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 13/25 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L52","11",{}]]