26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample a111e77f244f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a111e77f244f…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T585,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp")28:T540,"0<0402&https://www.globalsign.com/repository/0" - Source: "00000000-00003140.00000001.151128.06234000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0vo0m0a20402&https://www.globalsign.com/repository/08i_a@glg&emky,x67d_&p+r)5sglobalsign" - Source: "00000000-00003140.00000001.151128.06234000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=1http://ocsp.globalsign.com/gsgccr45codesignca20200vo0m0a20402&https://www.globalsign.com/repository/0>0<0:4http://crl.globalsign.com/gsgccr45codesignca2020.crl0!gdv" - Source: "00000000-00003140.00000001.151128.06234000.00000004.mdmp") Found URL "https://www.autoitscript.com/autoit3/" - Source: "00000000-00003140.00000001.151128.06234000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/0-http://ocsp.globalsign.com/ca/gstsacasha384g40c7http://secure.globalsign.com/cacert/gstsacasha384g4.crt0we93:08060http://crl.globalsign.com/ca/gstsacasha384g4.crl0)x" - Source: "00000000-00003140.00000001.151128.06234000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr606/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/0wg+b_4heuhdi/$ktz" - Source: "00000000-00003140.00000001.151128.06234000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr30;/http://secure.globalsign.com/cacert/root-r3.crt06/0-0+%http://crl.globalsign.com/root-r3.crl0g@0>0<0402&https://www.globalsign.com/repository/0" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0vo0m0a20402&https://www.globalsign.com/repository/08i_a@glg&emky,x67d_&p+r)5sglobalsign" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=1http://ocsp.globalsign.com/gsgccr45codesignca20200vo0m0a20402&https://www.globalsign.com/repository/0>0<0:4http://crl.globalsign.com/gsgccr45codesignca2020.crl0!gdv" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://www.autoitscript.com/autoit3/" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/0-http://ocsp.globalsign.com/ca/gstsacasha384g40c7http://secure.globalsign.com/cacert/gstsacasha384g4.crt0we93:08060http://crl.globalsign.com/ca/gstsacasha384g4.crl0)x" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr606/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/0wg+b_4heuhdi/$ktz" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "http://103.217.252.120/pit/wp.phphttp://103.217.252.120/pit/wp.phpdigest" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "http://103.217.252.120/pit/wp.phpx:v" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://dry-band-ae8f.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://gentle-pond-2294.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://ray-wildflower-59b3.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://frosty-union-ff75.laserkusym.workers.dev/hapubws\gc.appdatalocalhrrt\," - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://dl.dropboxusercontent.com/scl/fi/hf1fvwk41axwoo1ca9vjt/tasw.txt?rlkey=nir6ntfp3npu4o6ylxle3tfipcfsfappdatalocalecoopt" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "http://103.217.252.120/pit/wp.phplocalappdata=c:\users\hapubws\appdata\localnvm_home=c:\users\hapubws\appdata\roaming\nvmprogramfiles(x86)=c:\program" - Source: "00000000-00003140.00000002.153048.06234000.00000004.mdmp") Found URL "https://www.google.com/https://www.bing.com/https://search.yahoo.com/https://duckduckgo.com/https://www.facebook.com/https://t.co/https://www.linkedin.com/https://www.instagram.com/https://www.reddit.com/https://github.com/https://stackoverflow.com/https://news.ycombinator.com/http/1.1upgrade-insecure-requestscontent-type:" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "http://103.217.252.120/103.217.252.120processor_identifier=intel64" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://gist.github.com/zavrayah/5bfe6f9579d6cb3eabe39cb08858a69d.jspitbulhttps://bitbucket.org/serky/repyx/raw/main/fq.txthttps://gist.github.com/zavrayah/cd51dad4cc95097c376cbb7e6c7523b1.jshttps://dl.dropboxusercontent.com/scl/fi/hf1fvwk41axwoo1ca9vjt/tasw.txt?rlkey=nir6ntfp3npu4o6ylxle3tfip8666130441:aaf53uu2cnivaqmrxyksquf38469h55doai-1003954952091https://dry-band-ae8f.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://gentle-pond-2294.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://ray-wildflower-59b3.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://frosty-union-ff75.laserkusym.workers.dev/https://gist.github.com/lorysaym/0ddb32a75e3f2334728a43b632e0e3dc.js0xeff1fa370c36eb8a611fc75722333f6638c6c3f3hqm247eqfie75m99vkx8gdnw19ur89yywj4t6akk93rgujbv2ju3gxb69a8r79smgqzzhttps://api.etherscan.io/v2/apiasgyprimnonepostjsonabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789username@gmail.com" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://class=\" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://api.telegram.org/botdescription&startblock=0&endblock=99999999&sort=desc&page=1&offset=10&chainid=1&apikey=?module=account&action=txlist&address=" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "http://software\microsoft\windows" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://gist.github.com/zavrayah/5bfe6f9579d6cb3eabe39cb08858a69d.jspitbulhttps://bitbuckerky/repyx/raw/main/fq.txthttps://gist.github.com/zavrayah/cd51dad4cc95097c376cbb7e6c7523b1.jshttps://dl.dropboxusercontent.co/hf1fvwk41axwoo1ca9vjt/tasw.txt?rlkey=nir6ntfp3npu4o6ylxle3tfip8666130441:aaf53uu2cnivaqmrxyksquf38469h55doai-1003954952091https://x-ae8f.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://gist.github.com/lorysaym/0ddb32a75e3f2334728a43b632e0e3dc.js0xeff1fa370c36eb8a611fc7\6638c6c3f3hqm247eqfie75m99vkx8gdnw19ur89yywj4t6akk93rgujbv2ju3gxb69a8r79smgqzzhttps://api.etherscan.io/v2/apiasgyprim=rr9c:\users\nuvmn\desktop\ryxuz-primehttp18-04-2026\ryxuz\b3\pitbull\svchost\release\svchost.pdbgctl.text$di.text$mn.text$x.text$yd.idata$5.00cfg.crt$xca.crt$xcaa.crt$xcc.crt$xcl.crt$xcu.crt$xcz.crt$xia.crt$xiaa.crt$xiac.crt$xic.crt$xiz.crt$xla)9.crt$xpxa.crt$xpz.crt$xta.crt$xtz.rdata.rdata$t.rdata$r.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$iaa.rtc$izz.rtc$taa.rtc$tzz.tls.tls$.tls$zzz.xdata$x.idata$2.idata$3.idata$4.idata$6.data.data$r.data$rs.bss.fptable.rsrc$01.rsrc$02" - Source: "00000000-00003140.00000002.153048.06B0C000.00000004.mdmp") Found URL "https://www.google.com/https://www.bing.com/https://search.yahoo.com/https://duckduckgo.com/https://www.facebook.com/https://t.co/https://www.linkedin.com/https://www.instagram.com/https://www.reddit.com/https://github.com/https://stackoverflow.com/https://news.ycombinator.com/http/1.1upgrade-insecure-requestscontent-type:" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "https://gist.github.com/zavrayah/5bfe6f9579d6cb3eabe39cb08858a69d.jspitbulhttps://bitbucket.org/serky/repyx/raw/main/fq.txthttps://gist.github.com/zavrayah/cd51dad4cc95097c376cbb7e6c7523b1.jshttps://dl.dropboxusercontent.com/scl/fi/hf1fvwk41axwoo1ca9vjt/tasw.txt?rlkey=nir6ntfp3npu4o6ylxle3tfip8666130441:aaf53uu2cnivaqmrxyksquf38469h55doai-1003954952091https://dry-band-ae8f.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "https://gentle-pond-2294.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "https://ray-wildflower-59b3.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "https://frosty-union-ff75.laserkusym.workers.dev/https://gist.github.com/lorysaym/0ddb32a75e3f2334728a43b632e0e3dc.js0xeff1fa370c36eb8a611fc75722333f6638c6c3f3hqm247eqfie75m99vkx8gdnw19ur89yywj4t6akk93rgujbv2ju3gxb69a8r79smgqzzhttps://api.etherscan.io/v2/apiasgyprimnonepostjsonabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789username@gmail.com" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "https://class=\" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "https://api.telegram.org/botdescription&startblock=0&endblock=99999999&sort=desc&page=1&offset=10&chainid=1&apikey=?module=account&action=txlist&address=" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "http://software\microsoft\windows" - Source: "00000000-00003140.00000002.153048.06C08000.00000004.mdmp") Found URL "https://www.google.com/https://www.bing.com/https://search.yahoo.com/https://duckduckgo.com/https://www.facebook.com/https://t.co/https://www.linkedin.com/https://www.instagram.com/https://www.reddit.com/https://github.com/https://stackoverflow.com/https://news.ycombinator.com/http/1.1upgrade-insecure-requestscontent-type:" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found URL "https://gist.github.com/zavrayah/5bfe6f9579d6cb3eabe39cb08858a69d.jspitbulhttps://bitbucket.org/serky/repyx/raw/main/fq.txthttps://gist.github.com/zavrayah/cd51dad4cc95097c376cbb7e6c7523b1.jshttps://dl.dropboxusercontent.com/scl/fi/hf1fvwk41axwoo1ca9vjt/tasw.txt?rlkey=nir6ntfp3npu4o6ylxle3tfip8666130441:aaf53uu2cnivaqmrxyksquf38469h55doai-1003954952091https://dry-band-ae8f.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found URL "https://gentle-pond-2294.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found URL "https://ray-wildflower-59b3.zavrayah.workers.dev/" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found URL "https://frosty-union-ff75.laserkusym.workers.dev/https://gist.github.com/lorysaym/0ddb32a75e3f2334728a43b632e0e3dc.js0xeff1fa370c36eb8a611fc75722333f6638c6c3f3hqm247eqfie75m99vkx8gdnw19ur89yywj4t6akk93rgujbv2ju3gxb69a8r79smgqzzhttps://api.etherscan.io/v2/apiasgyprimnonepostjsonabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789username@gmail.com" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found URL "https://class=\" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found URL "https://api.telegram.org/botdescription&startblock=0&endblock=99999999&sort=desc&page=1&offset=10&chainid=1&apikey=?module=account&action=txlist&address=" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found URL "http://software\microsoft\windows" - Source: "00000000-00003140.00000002.153048.070D1000.00000040.mdmp")47:T5de,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp")48:T45a,Found registry query API: "RegQueryInfoKeyA" in file "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin" Found registry query API: "RegQueryValueExA" in file "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin" Found registry query API: "RegOpenKeyExA" in file "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin" Found registry query API: "RegOpenKeyExA" in "00000000-00002472.00000000.149139.5A059000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00002472.00000000.149139.5A059000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002472.00000000.149139.5A059000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003140.00000002.153048.00A03000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003140.00000002.153048.00A03000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00003140.00000002.153048.00A03000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003140.00000002.153048.00A03000.00000002.mdmp"49:T458,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp")4a:T431,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp")4b:T5de,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp")4c:Tb77,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp")4d:T4ad,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00002472.00000001.149246.5A05E000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp")4e:T1257,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp")4f:T987,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002472.00000001.149246.5A05E000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp")50:Tec4,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp")51:T5e0,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "a111e77f244f7ced8fea48db8d7ea4648e0a12715b16de0e1473965084d65465.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002472.00000000.149139.5A059000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003140.00000002.153048.00A03000.00000002.mdmp, 00000000-00003140.00000002.153048.06B0C000.00000004.mdmp, 00000000-00003140.00000002.153048.06C08000.00000004.mdmp, 00000000-00003140.00000002.153048.070D1000.00000040.mdmp")52:Taab," HTTP/1.1 400 Bad Request\nServer: nginx\nDate: Mon\n 20 Apr 2026 08:50:14 GMT\nContent-Type: text/html; charset=UTF-8\nTransfer-Encoding: chunked\nConnection: keep-alive with response body ==>C3AFC2BBC2BF7B226572726F72223A22496E76616C6964204A534F4E2E227D.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69e5e87124fb3281750f1a04"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e5e87124fb3281750f1a04"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" \"{\"uid\":\"1cc6cc1ef2c3a4ec873bc2ea4b5b4ed66068eddb4b821aade75dc0f86285c7c5\",\"st\":\"Idle\",\"msg\":\"Awaiting task\",\"tid\":\"none\",\"bv\":\"ASGYPRIM 19-04-2026\",\"priv\":\"Yes\",\"src\":\"DNS (ninikima.com)\",\"sys\":{\"os\":\"Windows 10 Pro\",\"mem\":\"8.0 GB\",\"uptime\":\"10d\n 12h\n 25m\"}}\" HTTP/1.1 200 OK\nServer: nginx\nDate: Mon\n 20 Apr 2026 08:50:14 GMT\nContent-Type: application/json\nTransfer-Encoding: chunked\nConnection: keep-alive\nVary: Accept-Encoding with response body ==>C3AFC2BBC2BF5B5D.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69e5e87124fb3281750f1a04"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Cameroon.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"Cameroon.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69e5e87124fb3281750f1a04"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Cameroon.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\IXP000.TMP\\Cameroon.exe]- [targetUID: 00000000-00003140]\n \"EcoOptimize360.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"- Location: [%LOCALAPPDATA%\\EcoOptimize360 Dynamics Inc\\EcoOptimize360.exe]- [targetUID: 00000000-00003140]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69e5e87124fb3281750f1a04"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"