24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Capa_accept_command_line_arguments Sample 9dfc2d34a92b… — Score 61/100 — Hybrid Analysis","description":"Malicious verdict for sample 9dfc2d34a92b…. Malware family: Capa_accept_command_line_arguments. Threat score 61/100. 6/24 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce","keywords":["Malicious","Capa_accept_command_line_arguments","malware analysis","sandbox report","threat intelligence","9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce"],"about":{"@type":"SoftwareApplication","name":"support.client.exe","applicationCategory":["peexe","executable"],"identifier":"9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce","additionalType":"Malicious sample"},"threatScore":61,"malwareFamily":"Capa_accept_command_line_arguments","antivirusDetections":{"malicious":6,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T704,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "support.client.exe") Found reference to "edG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp")26:T94a,Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; File: "support.client.exe") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "support.client.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "support.client.exe") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; File: "support.client.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "support.client.exe") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "support.client.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "support.client.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "support.client.exe") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "support.client.exe") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp")27:T83c,Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-109-00404F96 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-109-00404F96 Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-282-004099D3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-282-004099D3 Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-347-00404AE1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-347-00404AE1 Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-392-004059B3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-392-004059B3 Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-393-0040585A Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-393-0040585A Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-394-004058B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-394-004058B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-439-00408A92 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-439-00408A92 Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-440-004086AD Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-440-004086AD Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-441-0040887A Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-441-0040887A Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-442-0040878C Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-442-0040878C Assembly shows XOR instruction xor eax ebp in Stream UID: 11736-443-00408417 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11736-443-00408417 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 11736-476-0040A495 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 11736-476-0040A495 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 11736-476-0040A495 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 11736-476-0040A49528:Tef2,"support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000009e296077a8c7a7000000000028000000240000000000a600d0ef79000000000000000000000000000000000000000000d0077d0030000000000000000e00000000007d0000000000c30000000000000000000000e0c4a70008b2a6000e000000000000002000000000007d00d0017d00040b7d0000000000000b7d0000000000c8ef790050f55f77a8c7a70030f079007cf07900 (UID: 00000000-00005384) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005384) "support.client.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005384) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000060ef790004ef7900226ea8750000ca04000000002d6ea8757813e2772d000000ecb7f57588ef790000007d00e888b1005853a8000e00000080000000c8ee790000007d004cef790070c8a975848d3502feffffff2d000000d0cc0476270000001cef7900856aaa751c23af755cef7900f85faa7508000000bb69a975b269a9752013e2772d000000ecb7f57527000000d0cc047630ef79002d000000d0cc04762700000060ef7900856aaa751c23af75a8ef79007e8a0376ee8c0376738a03761f257b3b2d000000ecb7f57527000000d0cc0476b413ca044813ca041f257b3b70ef7900fc5241765cf07900e08403768f3b3d4dfeffffff738a0376 (UID: 00000000-00005384) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f260775f59bcc40300000084ef7900cd016177e0feb1004a000000c8ef79002584fc75e0feb1009829ca04c8ef79004484fc75f8534176f4ef790037c1f8755384fc75bcef790099a24c0013cc3f706fb66858ddd9e2db7f381ffb7f257b3bf8ef7900d985fc7593b7c5c493b7c5c4010000004e85fc75068621746bf17cb8f80b9244a510d5f59626b03357257b3b08f079001dce03761e0000000000bb73feffffffed8203760000f3750000000000000000db3a7b3b28f07900 (UID: 00000000-00005384) "support.client.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000007d00d0017d00040b7d0000000000000b7d0000000000a8ef7900591660772400000000000000000000000000a6000000000030000000b4a1b10090a1b10037065f77020000000000a6002400000000000000b4ef7900c8ef7900ee13607701000000ee1360770000000000000000f0826f750758bcc4e0ef790032ba61779ca1b10000000000000000000000000008f079009651a4739ca1b100000000000000a27336e0a77300000000000000000100000013f0f4206cf079000dc7a7730000a273facda7738fc8a7737f008d200000a27380f07900010000000000c273feffffffa0f0790000aa9a73000000000000000070cab00050f07900 (UID: 00000000-00005384)29:T602,"support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER"; Key: "") "support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES"; Key: "") "support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CRLS"; Key: "") "support.client.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CTLS"; Key: "") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\5BDEFE580A816661CDB57A57107BF4187486EFCC"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\6F474206BCBB391BB82BA9E5DC0302DEF37AEBBE"; Key: "BLOB") "support.client.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3"; Key: "BLOB")2a:T533,"support.client.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter dfshim (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfdll.dll (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005384) "support.client.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005384)2b:T13a3,"support.client.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter ShOpenVerbApplicationW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo_RetAddr (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter ActivateDeploymentW (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00005384) "support.client.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005384)2c:T43ce,Found reference to API (Indicator: "CertOpenSystemStoreA"; File: "support.client.exe") Found reference to API (Indicator: "CertCreateCertificateContext"; File: "support.client.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "support.client.exe") Found reference to API (Indicator: "CertFindAttribute"; File: "support.client.exe") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "support.client.exe") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; File: "support.client.exe") Found reference to API (Indicator: "CertCloseStore"; File: "support.client.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "support.client.exe") Found reference to API (Indicator: "CryptMsgGetParam"; File: "support.client.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "support.client.exe") Found reference to API (Indicator: "GetLastError"; File: "support.client.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "support.client.exe") Found reference to API (Indicator: "DecodePointer"; File: "support.client.exe") Found reference to API (Indicator: "ExitProcess"; File: "support.client.exe") Found reference to API (Indicator: "GetOEMCP"; File: "support.client.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "support.client.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "support.client.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "support.client.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "support.client.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "support.client.exe") Found reference to API (Indicator: "FindClose"; File: "support.client.exe") Found reference to API (Indicator: "GetStdHandle"; File: "support.client.exe") Found reference to API (Indicator: "TlsSetValue"; File: "support.client.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "support.client.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "support.client.exe") Found reference to API (Indicator: "TerminateProcess"; File: "support.client.exe") Found reference to API (Indicator: "TlsFree"; File: "support.client.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "support.client.exe") Found reference to API (Indicator: "GetFileType"; File: "support.client.exe") Found reference to API (Indicator: "SetStdHandle"; File: "support.client.exe") Found reference to API (Indicator: "FreeLibrary"; File: "support.client.exe") Found reference to API (Indicator: "Sleep"; File: "support.client.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "support.client.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "support.client.exe") Found reference to API (Indicator: "SetLastError"; File: "support.client.exe") Found reference to API (Indicator: "RtlUnwind"; File: "support.client.exe") Found reference to API (Indicator: "LocalAlloc"; File: "support.client.exe") Found reference to API (Indicator: "HeapSize"; File: "support.client.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "support.client.exe") Found reference to API (Indicator: "GetACP"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "support.client.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "support.client.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "support.client.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "support.client.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "support.client.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "support.client.exe") Found reference to API (Indicator: "CreateFileW"; File: "support.client.exe") Found reference to API (Indicator: "HeapFree"; File: "support.client.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "support.client.exe") Found reference to API (Indicator: "LocalFree"; File: "support.client.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "support.client.exe") Found reference to API (Indicator: "FindNextFileA"; File: "support.client.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "support.client.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "support.client.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "support.client.exe") Found reference to API (Indicator: "LCMapStringW"; File: "support.client.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "support.client.exe") Found reference to API (Indicator: "TlsAlloc"; File: "support.client.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "support.client.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "support.client.exe") Found reference to API (Indicator: "HeapAlloc"; File: "support.client.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "support.client.exe") Found reference to API (Indicator: "CloseHandle"; File: "support.client.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "support.client.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "support.client.exe") Found reference to API (Indicator: "WriteFile"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "support.client.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "support.client.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "support.client.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "support.client.exe") Found reference to API (Indicator: "GetProcAddress"; File: "support.client.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "support.client.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "support.client.exe") Found reference to API (Indicator: "RaiseException"; File: "support.client.exe") Found reference to API (Indicator: "TlsGetValue"; File: "support.client.exe") Found reference to API (Indicator: "GetCPInfo"; File: "support.client.exe") Found reference to API (Indicator: "FlsAlloc"; File: "support.client.exe") Found reference to API (Indicator: "FlsFree"; File: "support.client.exe") Found reference to API (Indicator: "FlsGetValue"; File: "support.client.exe") Found reference to API (Indicator: "FlsSetValue"; File: "support.client.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "support.client.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "support.client.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "support.client.exe") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCertificateContext"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CertFindAttribute"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgGetParam"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp")2d:T6d5,"support.client.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73dc0000 "support.client.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74110000 "support.client.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74110000 "support.client.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74110000 "support.client.exe" loaded module "KERNEL32.DLL" at base 758c0000 "support.client.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 773f0000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 747b0000 "support.client.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 758c0000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73d70000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74700000 "support.client.exe" loaded module "DFSHIM" at base 73c20000 "support.client.exe" loaded module "ADVAPI32.DLL" at base 74cd0000 "support.client.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73770000 "support.client.exe" loaded module "SHLWAPI.DLL" at base 742f0000 "support.client.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 753c0000 "support.client.exe" loaded module "VERSION.DLL" at base 73c10000 "support.client.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFDLL.DLL" at base 73740000 "support.client.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 736c0000 "support.client.exe" loaded module "USER32.DLL" at base 77440000 "support.client.exe" loaded module "RPCRT4.DLL" at base 743d0000 "support.client.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 758c00002e:T5ad,"support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "support.client.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")2f:Ta7f,"support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SUPPORT.CLIENT.EXE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "support.client.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")30:T746,"support.client.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "support.client.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "support.client.exe" trying to access non-existent file "C:\FLTLIB.DLL" "support.client.exe" trying to access non-existent file "C:\MSVCP140.DLL" "support.client.exe" trying to access non-existent file "C:\MSVCP140.dll" "support.client.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "support.client.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "support.client.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "support.client.exe" trying to access non-existent file "C:\BCRYPT.DLL" "support.client.exe" trying to access non-existent file "C:\bcrypt.dll" "support.client.exe" trying to access non-existent file "C:\DFSHIM.DLL" "support.client.exe" trying to access non-existent file "C:\dfshim.DLL" "support.client.exe" trying to access non-existent file "C:\VERSION.DLL" "support.client.exe" trying to access non-existent file "C:\VERSION.dll" "support.client.exe" trying to access non-existent file "C:\MSCOREE.DLL" "support.client.exe" trying to access non-existent file "C:\mscoree.dll" "support.client.exe" trying to access non-existent file "C:\URLMON.DLL" "support.client.exe" trying to access non-existent file "C:\urlmon.dll" "support.client.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "support.client.exe" trying to access non-existent file "C:\iertutil.dll" "support.client.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "support.client.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "support.client.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL"31:Tc70,Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "www.digicert.com110/" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0" Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0p" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl07" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0j" Pattern match: "http://ocsp.digicert.com0h" Pattern match: "http://cacerts.digicert.com/digicertevcodesigningca-sha2.crt0" Pattern match: "crl4.digicert.com/evcodesigningsha2-g1.crl0k" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "www.digicert.com1.0" Pattern match: "http://crl3.digicert.com/assured-cs-g1.crl00" Pattern match: "http://crl4.digicert.com/assured-cs-g1.crl0l" Pattern match: "http://ocsp.digicert.com0l" Pattern match: "http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0" Pattern match: "http://ocsp.digicert.com0i" Pattern match: "http://cacerts.digicert.com/digicerthighassuranceevrootca.crt0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0@" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "http://crl3.digicert.com/sha2-assured-ts.crl02" Pattern match: "http://crl4.digicert.com/sha2-assured-ts.crl0" Pattern match: "http://ocsp.digicert.com0o" Pattern match: "cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0" Pattern match: "crl3.digicert.com/digice" Pattern match: "cert.com/cps0" Pattern match: "http://ocsp.di" Pattern match: "crl3.digicert.com/digic" Pattern match: "igicert.com/digicerttrustedg4rsa4096sha256timestampiw" Pattern match: "certs.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0"32:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005384.00000001.124145.00A60000.00000004.mdmp")33:T9fc,"support.client.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005384) "support.client.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005384) "support.client.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005384)34:T4ee,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "support.client.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "support.client.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "support.client.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "support.client.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "support.client.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005384.00000001.124145.00F0B000.00000002.mdmp")35:T1eea,"support.client.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "support.client.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\7B0F360B775F76C94A12CA48445AA2D2A875701C"; Key: "BLOB"; Value: "0300000001000000140000007B0F360B775F76C94A12CA48445AA2D2A875701C2000000001000000B4060000308206B030820498A003020102021008AD40B260D29C4C9F5ECDA9BD93AED9300D06092A864886F70D01010C05003062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F74204734301E170D3231303432393030303030305A170D3336303432383233353935395A3069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E6720525341343039362053484133383420323032312043413130820222300D06092A864886F70D01010105000382020F003082020A0282020100D5B42F42D028AD78B75DD539591BB18842F5338CEB3D819770C5BBC48526309FA48E68D85CF5EB342407E14B4FD37843F417D71EDAF9D2D5671A524F0EA157FC8899C191CC81033E4D702464B38DE2087D347D4C8057126B439A99F2C53B1FF2EFCB475A13A64CB3012025F310D38BB2FB08F08AE09D09C065A7FA98804935873D5119E8902178452EA19F2CE118C21ACCC5EE93497042328FFBC6EA1CF3656891A24D4C8211485268DE10BD14575DE8181365C57FB24F852C48A4568435D6F92E9CAA0015D137FE1A0694C27CC8EA1B32E6CAC2F4A7A3030E74A5AF39B6AB6012E3E8D6B9F731E1DCADE418A0D8C1234747B3A10F6EA3AB6D9806831BB76A672DD2BD441A9210818FB03B09D7C79B325AC2FF6A60548B49C193EDE1B45CE06FEB26F98CD5B2F93810E6EACE91F5BED3FB6F9361345CBC93452883362A66285FB073CE8B262506B283D45CF615194CED62E05E33F2E8E8EC0AA7B0032B91B23679BEF7AD081E75A665CCBBE34850F377911AFEDB50A246C8615898F57C02163C8328AD3986ECD4B70D53D0F847E675308DEC30937614A65B4B5D74614D3F129176DEBF58CB72102941F0D5C56D267668114113589ADC262B01F4894D59DB78CF814A3E40475FC98150738510232159608A6454C1CC211AE838197C661CCD78384530994FFF634F4CBBAA0D0853417C583D47B3FAB6EC8C320902CC6C3C0C56110203010001A38201593082015530120603551D130101FF040830060101FF020100301D0603551D0E041604146837E0EBB63BF85F1186FBFE617B088865F44E42301F0603551D23041830168014ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F300E0603551D0F0101FF04040302018630130603551D25040C300A06082B06010505070303307706082B06010505070101046B3069302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D304106082B060105050730028635687474703A2F2F636163657274732E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63727430430603551D1F043C303A3038A036A0348632687474703A2F2F63726C332E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63726C301C0603551D20041530133007060567810C01033008060667810C010401300D06092A864886F70D01010C050003820201003A23443D8D0876EE8FBC3A99D356E0021AA5F84834F32CB6E67466F79472B100CAAF6C302713129E90449F4BFD9EA37C26D537BC3A5D486D95D53F49F427BB16814550FD9CBDB685E0767E3771CB22F75AAA90CFF5936AE3EB20D1D55079889A8A8AC1B6BDA148187EDCD8801A111918CD61998156F6C9E376E7C4E41B5F43F83E94FF76393D9ED499CF4ADD28EB5F26A1955848D51AFED7273FFD90D17686DD1CB0605CF30DA8EEE089A1BD39E1384EDA6EBB369DFBE521535AC3CAE96AF1A23EDB43B833C84F38149299F5DDCE546DD95D02141F40337C03E295B2C221757352CB46D8C4341CA2A54B8DCD6F76372C853F1ACE26E918BE9007B0437F9588208270F0CCCAEFFD29355C1F893855F7378A8B09A1CB0BE9311AFF2E195C3971E1BE9CA70A06D62667B792E64E5FDE7AAC49CF2EA47492ADDB3CA49C861FE3C1561B2B23FF8FB5EA887B706BE6A0BAFD3A3F45A6C4E81691528B41C048844B964DAB4440E38DF01528CEEDF11856072A2F10C40C08643C338FAE288C3CCB8F880B0DBF3BF4CE1E7B8EEFB5EBCBB7F07713E6E7283FAC12AEA52F226C41F9825C1566CC6C0ECAC586C3F626330C074BA0D307026A6A4030484B34A85120BBAD1B8508E2590D6DCA05502BEA4A1C9EA5FDA0A71F0674E7F2D65290FDAF854821F9573BB49C03ED8645F4B4616EBF68E2266086EAC8AFA9FE941DE7631B3A8656784E00") "support.client.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\4C2272FBA7A7380F55E2A424E9E624AEE1C14579"; Key: "BLOB"; Value: "0300000001000000140000004C2272FBA7A7380F55E2A424E9E624AEE1C145792000000001000000640700003082076030820548A00302010202100B9360051BCCF66642998998D5BA97CE300D06092A864886F70D01010B05003069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E67205253413430393620534841333834203230323120434131301E170D3232303831373030303030305A170D3235303831353233353935395A3065310B30090603550406130255533110300E06035504081307466C6F72696461310E300C0603550407130554616D706131193017060355040A1310436F6E6E656374776973652C204C4C433119301706035504031310436F6E6E656374776973652C204C4C4330820222300D06092A864886F70D01010105000382020F003082020A0282020100EC489826D08D2C6DE21B3CD3676DB1E0E50CB1FF75FF564E9741F9574AA3640AA8297294A05B4DB68ABD0760B6B05B50CE92FF42A4E390BE776A43E9961C722F6B3A4D5C880BCC6A61B4026F9137D36B2B7E9B86055876B9FA860DBCB164FE7F4B5B9DE4799AE4E02DC1F0BEE01E5D032933A2827388F8DB0B482E76C441B1BD50909EF2023E1FB62196C994CE052266B28CD89253E6416044133139764DB5FC45702529536BF82C775F9EC81FA27DC409530325F40CDEF95B81B9CE0D42791CEE72E7BD1B36C257B52257C65A28970E457513989434BFC239E2992B193E1B3CC3F11CCDD1D26D4EC9845099AB913906A42069AF999C0071169B45A2EA1AA666F1904E8ACB05E1823A359A291FD46B4EF7AED5935BB6AB17EBF077210726930C90F01761D6544A94E8FA614CC41D817EEC734B1C3D3AFB7C58FB256F0C09EDC1459BDDBFF9940ED1958570265D67AF79A9B6A16AFFD70FC6328C9810D5DC186E39AF6FBCAD49A270F237E6BCD5DE0BC014BC3179CD79776591340311A42CA94F33416C2E01B59BD1D71DE86ACE6716BC90B2D7695D155039AA08FBAC19A4D93FB784230A20A485287A16355645FC09142C602D140FA046B7BFD75328184FF7BDF8F9E0D65E6201C8D242931047F59BD328AC353777CCEFA60408887B84FC3631301463461A1D73C0B5CC74D6D82905DDF923BDBAB027A311CC38D3FA16F639A50203010001A382020630820202301F0603551D230418301680146837E0EBB63BF85F1186FBFE617B088865F44E42301D0603551D0E04160414338CE10A6E06D9C6ED0BC6CAE736CEFB8188646A300E0603551D0F0101FF04040302078030130603551D25040C300A06082B060105050703033081B50603551D1F0481AD3081AA3053A051A04F864D687474703A2F2F63726C332E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C3053A051A04F864D687474703A2F2F63726C342E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C303E0603551D20043730353033060667810C0104013029302706082B06010505070201161B687474703A2F2F7777772E64696769636572742E636F6D2F43505330819406082B06010505070101048187308184302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D305C06082B060105050730028650687474703A2F2F636163657274732E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E637274300C0603551D130101FF04023000300D06092A864886F70D01010B050003820201000AD79F00CF4984864C8981ECCE8718AA875647F6A74608C968E16568C7AA9D711ED7341676038067F01330C91621B27A2A8894C4108C268162A31F13F9757A7D6BB3C6F19BF27C3A29896D712D85873627D827CD6471761444FABF1D31E903F791143C5B4CE5E7444AACBA36D759AEBA3069D195226755CBC675AA747F77596C53C96E083C45BBA24479D6845EEA9F2B28BA29B4DCF0BCF14AA4CE176C24E2C1B8FEC3EE16E1C086DB6FDA97388859E83BE65C03F701395B78B842C6DD1533EF642CCA6FE50F6337D3F2DFEDD8B28F2B28E0C98EDD2151392E7CC75489F48859F1DE14C81B306EB50EED7BB78BE30EAADA76767C4CA523A11EEC5A2372D6122926AB1801A6A6778E9504791487EE47D4577154988802070F80FC535957658F954CD083546C5AFB5A6567B6761275F5DB20F70AB86FEEF94C7CFC65369D325121B69A82399BC7DC1962416F0F05CF1EEE64D495A3527E464E2C68DA0187093F97B673E43DDDBCC067E00713F1565FCFF8C3772D44B40A04E600644F22A990345F9A6B5B52963E82C81A0CE91D43A230F67B37D8DEBDA40EA3D59D305E18ADC1976516C12A8BA2BCA24143B12E9527B4DCA58872AA9B3A8C6AC563FC2DC02BF51BE889516D35A4BA9D062417B5BDCC50BA945FAE26B60D6AEC03984798A6A21D3FF793CC0849E81ED55B8027411C50DB776AE8FEEF2FDC2DAFB04345261DEDC05400")36:T590,Found string "FlsAlloc" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "CorExitProcess" (Source: support.client.exe, API is part of module: MSCOREEI.DLL) Found string "GetCurrentPackageId" (Source: support.client.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "LCMapStringEx" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: support.client.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: support.client.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: support.client.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: support.client.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: support.client.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: support.client.exe, API is part of module: MSVCRT.DLL) Found string "ShOpenVerbApplicationW" (Source: support.client.exe, API is part of module: DFSHIM.DLL)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":61,"unified_at_epoch_ms":1791263457286,"unified_at":"2026-10-06T05:10:57.286Z","metadata":{"hashes":{"sha256":"9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce","sha1":"c47df50e3377271cd7b005f2392ed5d39111c009","md5":"fdc1fc279a15ba9f8e02f1eb46616475","sha512":"40c553553f0570ce21b819ca83f7f75e969182949f1481a78d4e5b09ff5e518614013143201b3d9123a50713e78e1ddb33ef22d4cf82c19946d6e860a3d11c0d","ssdeep":"1536:qxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYR7SJE:4enkyfPAwiMq0RqRfbaWZJYYRa","ssdeep_chunks":["1536:qxoG6Kp","1536:xoG6KpY","1536:oG6KpY6","1536:G6KpY6Q","1536:6KpY6Qi","1536:KpY6Qi3","1536:pY6Qi3y","1536:Y6Qi3yj","1536:6Qi3yj2","1536:Qi3yj2w","1536:i3yj2wy","1536:3yj2wyq","1536:yj2wyq4","1536:j2wyq4H","1536:2wyq4Hw","1536:wyq4Hwi","1536:yq4HwiM","1536:q4HwiMO","1536:4HwiMO1","1536:HwiMO10","1536:wiMO10H","1536:iMO10HV","1536:MO10HVL","1536:O10HVLC","1536:10HVLCJ","1536:0HVLCJR","1536:HVLCJRp","1536:VLCJRps","1536:LCJRpsW","1536:CJRpsWr","1536:JRpsWr6","1536:RpsWr6c","1536:psWr6cd","1536:sWr6cda","1536:Wr6cdaW","1536:r6cdaWP","1536:6cdaWPB","1536:cdaWPBJ","1536:daWPBJY","1536:aWPBJYY","1536:WPBJYYR","1536:PBJYYR7","1536:BJYYR7S","1536:JYYR7SJ","1536:YYR7SJE","3072:qxoG6Kp","3072:xoG6KpY","3072:oG6KpY6","3072:G6KpY6Q","3072:6KpY6Qi","3072:KpY6Qi3","3072:pY6Qi3y","3072:Y6Qi3yj","3072:6Qi3yj2","3072:Qi3yj2w","3072:i3yj2wy","3072:3yj2wyq","3072:yj2wyq4","3072:j2wyq4H","3072:2wyq4Hw","3072:wyq4Hwi","3072:yq4HwiM","3072:q4HwiMO","3072:4HwiMO1","3072:HwiMO10","3072:wiMO10H","3072:iMO10HV","3072:MO10HVL","3072:O10HVLC","3072:10HVLCJ","3072:0HVLCJR","3072:HVLCJRp","3072:VLCJRps","3072:LCJRpsW","3072:CJRpsWr","3072:JRpsWr6","3072:RpsWr6c","3072:psWr6cd","3072:sWr6cda","3072:Wr6cdaW","3072:r6cdaWP","3072:6cdaWPB","3072:cdaWPBJ","3072:daWPBJY","3072:aWPBJYY","3072:WPBJYYR","3072:PBJYYR7","3072:BJYYR7S","3072:JYYR7SJ","3072:YYR7SJE","1536:4enkyfP","1536:enkyfPA","1536:nkyfPAw","1536:kyfPAwi","1536:yfPAwiM","1536:fPAwiMq","1536:PAwiMq0","1536:AwiMq0R","1536:wiMq0Rq","1536:iMq0RqR","1536:Mq0RqRf","1536:q0RqRfb","1536:0RqRfba","1536:RqRfbaW","1536:qRfbaWZ","1536:RfbaWZJ","1536:fbaWZJY","1536:baWZJYY","1536:aWZJYYR","1536:WZJYYRa"],"imphash":"37d5c89163970dd3cc69230538a1b72b"},"file_info":{"file_name":"support.client.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":83168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791262541000,"last_seen":1791263392000,"last_multi_scan":1791263392000}},"detections":{"summary":{"verdict":"malicious","score":61,"tags":null},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":46},"sandbox_signatures":{"informative_count":100,"suspicious_count":13,"malicious_count":0,"total":113},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare[RemoteAdmin]/Win32.ConnectWise","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"UDS:TrojanBanker.MSIL.Banker.hckn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HackTool/ConnectWiseControl.j","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_accept_command_line_arguments","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.ConnectWise.Win32.132","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Capa_accept_command_line_arguments","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies system certificates settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"suspicious","value":"Attempts to retrieve the system language code"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"support.client.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"support.client.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"support.client.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"support.client.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-935740738 [PID: 5384]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-935749964 [PID: 5384]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-935949898 [PID: 5384]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-935959654 [PID: 5384]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-936068199 [PID: 5384]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-936076777 [PID: 5384]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-936409616 [PID: 5384]\n \"support.client.exe\" queried SystemProcessInformation at 00000000-00005384-00000C15-936418342 [PID: 5384]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007988]\n Process \"WerFault.exe\" [UID: 00000000-00007732]\n Process \"WerFault.exe\" [UID: 00000000-00007268]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"support.client.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"support.client.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"support.client.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 11736-644-00401AAC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$26","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertOpenSystemStoreA\" (Indicator: \"CertOpenSystemStore\"; File: \"support.client.exe\")\n Found reference to API \"CertDeleteCertificateFromStore\" (Indicator: \"CertDeleteCertificateFromStore\"; File: \"support.client.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"support.client.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 29193; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 3151; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 74470; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 77260; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 77507; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"support.client.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"support.client.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"support.client.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"support.client.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.dll at 11736-347-00404AE1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"support.client.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"support.client.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"support.client.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 11736-662-00406893","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"support.client.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 10885)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"support.client.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"support.client.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"support.client.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe\" - (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\builds\\cc\\cwcontrol\\Product\\ClickOnceRunner\\Release\\ClickOnceRunner.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"306310,7672,3143,,CreateProcessW,kernel32.dll,\"00:32:14.671\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"support.client.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: support.client.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"support.client.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"support.client.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"support.client.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"th=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{4991D34B-80A1-4291\" in Source: 00000000-00005384.00000001.124145.00A60000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process support.client.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:5384:168:WilStaging_02\"\n Process support.client.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5384:168:WilStaging_02\"\n Process support.client.exe created mutex with name \"SM0:5384:168:WilStaging_02\"\n Process support.client.exe created mutex with name \"Local\\SM0:5384:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"support.client.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"noreply@vmware.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"th=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{4991D34B-80A1-4291\" in Source: 00000000-00005384.00000001.124145.00A60000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"support.client.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74700000\n \"support.client.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73D50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"support.client.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 743D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"support.client.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"support.client.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"support.client.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"support.client.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"support.client.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"support.client.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"support.client.exe\" file has an entrypoint instructions - \"call\t0x401853,jmp\t0x40130d,push\tebp,mov\tebp, esp,push\t0,call\tdword ptr [0x40b048],push\tdword ptr [ebp + 8],call\tdword ptr [0x40b044],push\t0xc0000409,call\tdword ptr [0x40b04c],push\teax,call\tdword ptr [0x40b050],pop\tebp,ret\t,push\tebp,mov\tebp, esp,sub\tesp, 0x324,push\t0x17,call\tdword ptr [0x40b054],test\teax, eax,je\t0x4014d5,push\t2,pop\tecx,int\t0x29,mov\tdword ptr [0x4118c0], eax,mov\tdword ptr [0x4118bc], ecx,mov\tdword ptr [0x4118b8], edx,mov\tdword ptr [0x4118b4], ebx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe\" [Source: 00000000-00005384-00000C47-2674306310]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00005384-00000C2B-936626590]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\dfdll.dll\" [Source: 00000000-00005384-00000C2B-936757351]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 4C:22:72:FB:A7:A7:38:0F:55:E2:A4:24:E9:E6:24:AE:E1:C1:45:79; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"support.client.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"support.client.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"support.client.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"support.client.exe\" queries basic process information of the \"C:\\support.client.exe\" (UID: 5384)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"support.client.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\dfsvc.exe.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"support.client.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"support.client.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"support.client.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"support.client.exe\" trying to touch file \"C:\\support.client.exe\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"support.client.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"support.client.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"\n \"support.client.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\mscoree.dll.local\"\n \"support.client.exe\" trying to access non-existent file \"C:\\.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"\n \"2.5.29.17\"\n \"2.5.29.31\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE6864388A8CEAE18F95FDCC19F408]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \",,RtlGetNtProductType,NTDLL.dll,\"00:32:14.62\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: support.client.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"support.client.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"support.client.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"support.client.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"support.client.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"support.client.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"support.client.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\support.client.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005384.00000001.124145.00A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"support.client.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"support.client.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"support.client.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"support.client.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005384.00000001.124145.00F0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"support.client.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"support.client.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"support.client.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"support.client.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"support.client.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"support.client.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 11736-403-00405E66","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\support.client.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/23 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature match for RMM tool activity (screenconnect) detected in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_RMM_ConnectWise_ScreenConnect_CERT\" matched file \"sample.bin\" as \"Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 11736-645-004055CE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.dll at 11736-345-00402F55","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"support.client.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\"; Key: \"7B0F360B775F76C94A12CA48445AA2D2A875701C\"; Value: \"\")\n \"support.client.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\"; Key: \"4C2272FBA7A7380F55E2A424E9E624AEE1C14579\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"support.client.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"System Security","name":"Modifies system certificates settings","description":"\"support.client.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\"; Key: \"7B0F360B775F76C94A12CA48445AA2D2A875701C\")\n \"support.client.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\7B0F360B775F76C94A12CA48445AA2D2A875701C\"; Key: \"BLOB\")\n \"support.client.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\"; Key: \"4C2272FBA7A7380F55E2A424E9E624AEE1C14579\")\n \"support.client.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"support.client.exe\" claimed CRC 117521 while the actual is CRC 136470","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CertDeleteCertificateFromStore\n GetCommandLineW\n GetStartupInfoW\n FindFirstFileExA\n TerminateProcess\n IsDebuggerPresent\n Sleep\n GetModuleFileNameW\n GetModuleFileNameA\n GetCommandLineA\n CreateFileW\n FindNextFileA\n UnhandledExceptionFilter\n LoadLibraryExW\n WriteFile\n GetModuleHandleExW\n GetModuleHandleW\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies system certificates settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Sample Crashed"],"sandbox_reports":[{"id":"6ac4829db234ab5baa068894","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":61,"malware_family":"Tool.ConnectWise","submit_name":"support.client.exe","analysis_start_time":"2026-10-06T05:09:52+00:00","indicators_count":{"informative":100,"suspicious":16,"malicious":0},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}],"processes":[{"pid":5384,"ppid":0,"name":"support.client.exe","command_line":"","sha256":"9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce","normalized_path":"C:\\support.client.exe","uid":"00000000-00005384","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7732,"ppid":5384,"name":"WerFault.exe","command_line":"-u -p 5384 -s 736","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005384","uid":"00000000-00007732"},{"pid":7268,"ppid":5384,"name":"WerFault.exe","command_line":"-u -p 5384 -s 736","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005384","uid":"00000000-00007268"},{"pid":7988,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 5384 -ip 5384","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007988","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["imm32.dll","ole32.dll","oleaut32.dll","user32.dll","msvcp_win.dll","combase.dll","imagehlp.dll","profapi.dll","urlmon.dll","uxtheme.dll","clbcatq.dll","fltLib.dll","gdi32full.dll","windows.storage.dll","iertutil.dll","mscoreei.dll","kernel32.dll","msasn1.dll","sechost.dll","rsaenh.dll","dfshim.dll","kernel.appcore.dll","powrprof.dll","mscoree.dll","apphelp.dll","sspicli.dll","msvcrt.dll","dfdll.dll","ucrtbase.dll","rpcrt4.dll","wintrust.dll","SHCore.dll","wow64cpu.dll","cryptbase.dll","bcryptprimitives.dll","vcruntime140.dll","msvcp140.dll","shlwapi.dll","bcrypt.dll","cfgmgr32.dll","ntdll.dll","KernelBase.dll","crypt32.dll","gdi32.dll","advapi32.dll","cryptsp.dll","shell32.dll","version.dll","wow64.dll","wow64win.dll","VxSSL32.dll","ws2_32.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\7B0F360B775F76C94A12CA48445AA2D2A875701C\\","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\\","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\7B0F360B775F76C94A12CA48445AA2D2A875701C\\7B0F360B775F76C94A12CA48445AA2D2A875701C","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\\4C2272FBA7A7380F55E2A424E9E624AEE1C14579","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"name":"SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]},{"name":"Local\\SM0:5384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac4829db234ab5baa068894"}]}]}},"report_ids":{"sandbox_job_ids":["6ac4829db234ab5baa068894"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Capa_accept_command_line_arguments Sample 9dfc2d34a92b… — Score 61/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9dfc2d34a92b…. Malware family: Capa_accept_command_line_arguments. Threat score 61/100. 6/24 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce"}],["$","meta","4",{"property":"og:title","content":"Malicious Capa_accept_command_line_arguments Sample 9dfc2d34a92b… — Score 61/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9dfc2d34a92b…. Malware family: Capa_accept_command_line_arguments. Threat score 61/100. 6/24 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9dfc2d34a92b8d415ba77712e5f681b08f2a566229042ac3e076b2bb79c5c1ce"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Capa_accept_command_line_arguments Sample 9dfc2d34a92b… — Score 61/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9dfc2d34a92b…. Malware family: Capa_accept_command_line_arguments. Threat score 61/100. 6/24 AV engines flagged this file. 0 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]