24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a17f22b67ecf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a17f22b67ecf…. Malware family: Trojan.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c"],"about":{"@type":"SoftwareApplication","name":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe","applicationCategory":["peexe","executable"],"identifier":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T10fc,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\desktop.ini" to "C:\$Recycle.Bin\S-1-5-18\AAAAAAAAAAA" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\AAAAAAAAAAA" to "C:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBB" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBB" to "C:\$Recycle.Bin\S-1-5-18\CCCCCCCCCCC" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\CCCCCCCCCCC" to "C:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDD" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDD" to "C:\$Recycle.Bin\S-1-5-18\EEEEEEEEEEE" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\EEEEEEEEEEE" to "C:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFF" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFF" to "C:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGG" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGG" to "C:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHH" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHH" to "C:\$Recycle.Bin\S-1-5-18\IIIIIIIIIII" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\IIIIIIIIIII" to "C:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJ" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJ" to "C:\$Recycle.Bin\S-1-5-18\KKKKKKKKKKK" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\KKKKKKKKKKK" to "C:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLL" to "C:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMM" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMM" to "C:\$Recycle.Bin\S-1-5-18\NNNNNNNNNNN" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\NNNNNNNNNNN" to "C:\$Recycle.Bin\S-1-5-18\OOOOOOOOOOO" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\OOOOOOOOOOO" to "C:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPP" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPP" to "C:\$Recycle.Bin\S-1-5-18\QQQQQQQQQQQ" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\QQQQQQQQQQQ" to "C:\$Recycle.Bin\S-1-5-18\RRRRRRRRRRR" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\RRRRRRRRRRR" to "C:\$Recycle.Bin\S-1-5-18\SSSSSSSSSSS" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\SSSSSSSSSSS" to "C:\$Recycle.Bin\S-1-5-18\TTTTTTTTTTT" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\TTTTTTTTTTT" to "C:\$Recycle.Bin\S-1-5-18\UUUUUUUUUUU" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\UUUUUUUUUUU" to "C:\$Recycle.Bin\S-1-5-18\VVVVVVVVVVV" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\VVVVVVVVVVV" to "C:\$Recycle.Bin\S-1-5-18\WWWWWWWWWWW" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\WWWWWWWWWWW" to "C:\$Recycle.Bin\S-1-5-18\XXXXXXXXXXX" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\$Recycle.Bin\S-1-5-18\XXXXXXXXXXX" to "C:\$Recycle.Bin\S-1-5-18\YYYYYYYYYYY"26:T101e,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000009e29ad77a0eae2020000000028000000240000000000e10218f05d000000000000000000000000000000000000000000d007800030000000000000000500000000008000b4ef5d006700b071000000000000000058e9e20238b0e10206000000000000002000000000008000d0018000140c800000000000100c80004800000010f05d0050f5ac77a0eae20278f05d00c4f05d00 (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e8ef5d008cef5d00226ed2760000dc04000000002d6ed276300b3aef2d000000ecb74f7510f05d000000800050e1e20210b0e102170000008000000050ef5d0000008000d4ef5d0070c8d3764495bf99feffffff2d000000d0cc5e7527000000a4ef5d00856ad4761c23d976e4ef5d00f85fd47608000000bb69d376b269d376580b3aef2d000000ecb74f7527000000d0cc5e75b8ef5d002d000000d0cc5e7527000000e8ef5d00856ad4761c23d97630f05d007e8a5d75ee8c5d75738a5d75a2a4c4a12d000000ecb74f7527000000d0cc5e752c11dc04c010dc04a2a4c4a1f8ef5d00fc529b75e4f05d00e0845d75aaa500d4feffffff738a5d75 (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000d2760000dc04000000002d6ed276d80b3aef11000000181a9572e8ef5d000000dc00e03edc0411000000000000008000000028ef5d0000000000acef5d0070c8d3764495bf99feffffff11000000503c96720e0000007cef5d00856ad4761c23d976bcef5d00f85fd47608000000bb69d376b269d376000b3aef11000000181a95720e000000503c967290ef5d0011000000503c96720e000000c0ef5d00856ad4761c23d97608f05d00b90e967236149672ae0e967227d43ed711000000181a95720e000000503c9672802edc04482edc0427d43ed7d0ef5d000a5e9572bcf05d00401496727786f4a5feffffffae0e9672c80e9672503c967238f05d00 (UID: 00000000-00002548)27:T15d4,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\C:\Users\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Videos\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Searches\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Saved Games\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Pictures\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Pictures\Saved Pictures\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Pictures\Camera Roll\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\OneDrive\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Music\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\backups\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20231002\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Links\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Favorites\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Favorites\Links\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Downloads\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Documents\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Documents\Outlook Files\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Desktop\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\Contacts\ni8pxbvnx.README.txt (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "CopyFileW" to copy \\?\C:\ni8pxbvnx.README.txt to new location \\?\%USERPROFILE%\AppData\ni8pxbvnx.README.txt (UID: 00000000-00002548)28:T1bdf,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002548)29:T8b2,Found reference to API (Indicator: "GetCommandLineA"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "FreeLibrary"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetLastError"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetProcAddress"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "LoadMenuW"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "LoadImageW"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "BitBlt"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "SelectObject"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetTextColor"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe")2a:T13a0,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74590000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74590000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74590000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "KERNEL32" at base 76fc0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73130000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "NTDLL" at base 77a90000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "NTDLL.DLL" at base 77a90000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "KERNEL32.DLL" at base 76fc0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "ADVAPI32.DLL" at base 76da0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "CRYPTBASE" at base 744a0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "USERENV.DLL" at base 73060000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "USER32.DLL" at base 751a0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "GDI32.DLL" at base 76860000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "SHELL32.DLL" at base 754d0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "OLE32.DLL" at base 74910000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0" at base 74e10000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "SHLWAPI.DLL" at base 75150000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "OLEAUT32.DLL" at base 744d0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "WTSAPI32.DLL" at base 74120000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "RSTRTMGR.DLL" at base 73030000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "NETAPI32.DLL" at base 72fc0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "WKSCLI" at base 732a0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "SRVCLI" at base 72fa0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "SAMCLI" at base 72f80000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "NETUTILS" at base 73260000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "LOGONCLI" at base 72f50000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "ACTIVEDS.DLL" at base 72f10000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "WININET.DLL" at base 72c00000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "WSOCK32.DLL" at base 72bf0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "WS2_32" at base 74aa0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "MPR.DLL" at base 743b0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "WINSPOOL.DRV" at base 72b80000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "GPEDIT.DLL" at base 72a70000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f60000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "RPCRT4.DLL" at base 74770000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74590000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 728d0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 727a0000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72790000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74590000 "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 745900002b:T4a3,"0f00100058f95d00b013ad77d8f95d00@ntdll.dll" "0700080034f95d0080fdb777b4f95d00@ntdll.dll" "09000a0034f95d00c0fdb777b4f95d00@ntdll.dll" "0800090034f95d00e0fcb777b4f95d00@ntdll.dll" "0700080034f95d00e085ab77b4f95d00@ntdll.dll" "09000a0034f95d008057ab77b4f95d00@ntdll.dll" "0800090034f95d00e056ab77b4f95d00@ntdll.dll" "1100120034f95d00702a4a74b4f95d00@CRYPTBASE.dll" "1100120034f95d00e02a4a74b4f95d00@CRYPTBASE.dll" "0c000d0034f95d00003df074b4f95d00@combase.dll" "0e000f0034f95d00106eea74b4f95d00@combase.dll" "0e000f0034f95d00606eea74b4f95d00@combase.dll" "1400150034f95d002023e774b4f95d00@combase.dll" "1000110034f95d008004ea74b4f95d00@combase.dll" "1200130034f95d0010c7f074b4f95d00@combase.dll" "1100120034f95d0050bcea74b4f95d00@combase.dll" "1500160034f95d00c0322a73b4f95d00@WKSCLI.DLL" "0c000d0034f95d001043fa72b4f95d00@SRVCLI.DLL" "0b000c0034f95d008039f872b4f95d00@SAMCLI.DLL" "0e000f0034f95d00d0daf872b4f95d00@SAMCLI.DLL" "0e000f0034f95d00403ef872b4f95d00@SAMCLI.DLL" "1000110034f95d00d0172673b4f95d00@NETUTILS.DLL" "0c000d0034f95d0050eff572b4f95d00@LOGONCLI.DLL" "0c000d0034f95d0050cff672b4f95d00@LOGONCLI.DLL" "0c000d0034f95d00d0cdf672b4f95d00@LOGONCLI.DLL"2c:T583,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" touched "WbemAdministrativeLocator Class" (Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")2d:T107d,"BrowserMetrics-660D4992-1AB4.pma.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "_emoji_codes.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\_emoji_codes.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "xml.dom.html.ni8pxbvnx" has type "COM executable for MS-DOS"- [targetUID: 00000000-00002548] "argparse.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\argparse.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_win32file.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32\test\__pycache__\test_win32file.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_pprint.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pprint.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_pegen.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_peg_generator\test_pegen.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "scp.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32comext\adsi\demos\__pycache__\scp.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "BCB4E4515F86FD37D2373B3343EFCD7C05DEE054.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "default_styles.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\default_styles.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "80789A0D6B7949A2A953294DA06480D9C6588096.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "40348E1301B4D9D6A21D28CF158ADC6F982ABAD1.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "settings.dat.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "_common.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\zoneinfo\_common.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "addressbook.acrodata.ni8pxbvnx" has type "COM executable for MS-DOS"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata.ni8pxbvnx]- [targetUID: 00000000-00002548] "_mapping.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\pygments\formatters\__pycache__\_mapping.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "Krasnoyarsk.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Krasnoyarsk.ni8pxbvnx]- [targetUID: 00000000-00002548] "Microsoft OneNote.searchconnector-ms.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.ni8pxbvnx]- [targetUID: 00000000-00002548] "warnings.h.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "iso2022_jp_ext.py.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "ni8pxbvnx.README.txt" has type "ASCII text with CRLF line terminators"- [targetUID: 00000000-00002548] "network.xbm.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\bitmaps\network.xbm.ni8pxbvnx]- [targetUID: 00000000-00002548] "iso2022_kr-utf8.txt.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\iso2022_kr-utf8.txt.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_ctypes.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_ctypes.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "invalid-false-casing.toml.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tomllib\data\invalid\boolean\invalid-false-casing.toml.ni8pxbvnx]- [targetUID: 00000000-00002548]2e:T9d1,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\TREATAS"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\TREATAS"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER32"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER32"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCHANDLER"; Key: ""; Value: "")2f:Tbad,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "COPYFILEBUFFEREDSYNCHRONOUSIO"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "COPYFILECHUNKSIZE"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "COPYFILEOVERLAPPEDCOUNT"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: ""; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}"; Key: "APPID"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING DIRECTORY"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOG FILE MAX SIZE"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}"; Key: ""; Value: "")30:Tdec,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\microsoftedgebackups\backups\microsoftedgebackup20231002\microsoftedgefavoritesbackup.html.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\documents\database1.accdb.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\documents\outlook files\outlook1.pst.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\documents\onenote notebooks\onenote 2010 guide\onenote guide.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\documents\onenote notebooks\my notebook\open notebook.onetoc2.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\documents\onenote notebooks\my notebook\quick notes.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\wireshark\recent_common.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\addons.json.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\blocklist.xml.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\compatibility.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\cert9.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\content-prefs.sqlite.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\favicons.sqlite.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\formhistory.sqlite.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\pkcs11.txt.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\places.sqlite.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\sitesecurityservicestate.txt.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\times.json.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\xulstore.json.ni8pxbvnx"31:T69d,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll"32:T9bc,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\USERENV.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\userenv.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\wtsapi32.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\RstrtMgr.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\NCRYPT.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\ncrypt.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\BCRYPT.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\bcrypt.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\NTASN1.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\NTASN1.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\NETAPI32.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\netapi32.dll" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\WKSCLI.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\SRVCLI.DLL" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to access non-existent file "C:\SAMCLI.DLL"33:Tc8a,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\programdata\ni8pxbvnx.ico" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\microsoftedgebackups\backups\microsoftedgebackup20231002\microsoftedgefavoritesbackup.html.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\database1.accdb.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\outlook files\outlook.pst.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\outlook files\outlook1.pst.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\unfiled notes.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\onenote 2010 guide\onenote guide.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\onenote 2010 guide\open notebook.onetoc2.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\my notebook\open notebook.onetoc2.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\documents\onenote notebooks\my notebook\quick notes.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\wireshark\recent.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\wireshark\recent_common.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\addons.json.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\addonstartup.json.lz4.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\blocklist.xml.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\compatibility.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\cert9.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\containers.json.ni8pxbvnx"34:T89c,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\pluginreg.dat.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdr.dat.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdri.dat.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Roaming\Adobe\Acrobat\11.0\Security\services_rdrk.dat.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\TileDataLayer\Database\EDB.log.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\TileDataLayer\Database\EDB00002.log.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\TileDataLayer\Database\EDBtmp.log.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\vxaction.log.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" writes a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\pluginreg.dat.ni8pxbvnx"35:T23da,Pattern match: "ihm.fk/(mn8/z-n3t/`|-v~wamuaa2}imc4?c)m5glaja9$uq$dwcwj" Pattern match: "q2.zc/h5\rs" Pattern match: "https://tox.chat2" Pattern match: "www.xinhuanet.com\ni8pxbvnx.r" Pattern match: "www.friv.com\ni8pxbvnx.readme" Pattern match: "www.xinhuanet.com\ni8pxbvnx.readme.txt" Pattern match: "www.xinhuanet.com\2014websit\ni8pxbvnx.readme" Pattern match: "www.xinhuanet.com\2014websit\js\ni8pxbvnx.rea" Pattern match: "www.xinhuanet.com\2014websit\js\kkplayer2.0_x" Pattern match: "www.friv.com\ni8pxbvnx.readme.txt" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\test\test_tomllib\data\invalid\multiline-literal-str\ni8pxbvnx.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\test\test_importlib\namespace_pkgs\both_portions\foo\ni8pxbvnx.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\win32\scripts\versionstamp\__pycache__\ni8pxbvnx.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\urllib3\packages\backports\__pycache__\ni8pxbvnx.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\setuptools\_vendor\importlib_resources\ni8pxbvnx.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\pythonwin\pywin\framework\editor\color\ni8pxbvnx.re" Heuristic match: "\\?\%localappdata%\programs\python\python311\lib\site-packages\pip\_vendor\urllib3\packages\backports\ni8pxbvnx.re" Heuristic match: "\?\c:\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\sta.ganjistatic1.com" Pattern match: "www.xinhuanet.com\*" Heuristic match: "\?\c:\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\script.auction.co.kr" Heuristic match: "??\c:\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\mpsnare.iesnare.com" Heuristic match: "\?\c:\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\aa.online-metrix.net" Heuristic match: "??\c:\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\script.auction.co.kr" Heuristic match: ":\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\secure-static.tagged.com" Heuristic match: ":\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\aa.online-metrix.net" Heuristic match: ":\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\mpsnare.iesnare.com" Heuristic match: ":\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\script.auction.co.kr" Heuristic match: ":\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\static.baifendian.com" Heuristic match: ":\users\hapubws\appdata\roaming\macromedia\flash player\#sharedobjects\3wdm7blb\an.moonbasa.com" Heuristic match: "t.com" Pattern match: "www.xinhuanet.com\2014websit" Heuristic match: "i8pxb~1.txtni8pxbvnx.readme.txt.comsecure-static.tagged.com" Heuristic match: "stagan~1.comsta.ganjistatic1.com" Pattern match: "www.friv.com" Pattern match: "www.xinhuanet.com" Heuristic match: "??\c:\users\hapubws\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#sta.ganjistatic1.com" Heuristic match: "??\c:\users\hapubws\appdata\roaming\macromedia\flash player\macromedia.com\support\flashplayer\sys\#aa.online-metrix.net" Pattern match: "www.friv.com\" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://tox.chat" Pattern match: "www.xinhuanet.com\ni8pxbvnx.readme" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\tkinter\test\test_tkinter\test_geometry_managers.py" Heuristic match: "est_unicode_file_functions.py" Heuristic match: "test_venv_multiprocessing.py" Heuristic match: "est_multiprocessing_spawn.py" Heuristic match: "lib\token.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\test___future__.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\ziptestdata\header.sh" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\ziptestdata\readme.md" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\ziptestdata\readme.md" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\_typed_dict_helper.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\_typed_dict_helper.py" Heuristic match: "ultiprocessing.py" Heuristic match: "mltests.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\reperf.py" Heuristic match: "re.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\__main__.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\_test_atexit.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\_test_eintr.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\_test_eintr.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\test___all__.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\test\__init__.py" Heuristic match: "!(.va" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\sqlite3\dbapi2.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\johabfreq.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\mbcssm.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\__init__.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\__init__.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\version.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\distlib\util.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\distlib\wheel.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\enums.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\escsm.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\escsm.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\enums.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\colorama\ansi.py" Heuristic match: "bcssm.py" Heuristic match: "ersion.py" Heuristic match: "_init__.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pythoncom.py" Heuristic match: "ar.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\idna\core.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\idna\core.py" Heuristic match: "ree.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\utf8prober.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\utf1632prober.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\utf8prober.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\latin1prober.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\langthaimodel.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\hebrewprober.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\gb2312freq.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\sbcharsetprober.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\universaldetector.py" Heuristic match: "\?\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\universaldetector.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\sbcsgroupprober.py" Heuristic match: "??\c:\users\hapubws\appdata\local\programs\python\python311\lib\site-packages\pip\_vendor\chardet\sjisprober.py"36:Tebc,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter aadtb.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AboveLockAppHost.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter accountaccessor.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AccountsRt.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AcGenral.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AcLayers.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AcSpecfc.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter ActivationClient.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter ActivationManager.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter ActiveSyncProvider.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AcWinRT.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter acwow64.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AcXtrnal.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AdaptiveCards.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AddressParser.dll (UID: 00000000-00002548) "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" called "FindNextFileW" with parameter AdmTmpl.dll (UID: 00000000-00002548)37:T978,Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp")38:T133b,Found reference to API "11730444882,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.125",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11828514591,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11730368822,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.125",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11798785035,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.156",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11869051668,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11764735666,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11890611939,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11555085969,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.046",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11780933230,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11813297587,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.156",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11848694714,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11715846610,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.125",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "11828115011,3740,3118,,FindNextFileW,kernel32.dll,"00:54:36.171",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000000.209677.02E10000.00000004.mdmp") Found reference to API "83694486838,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.109",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83776944800,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83791572041,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.156",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83710986294,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.109",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83807737269,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.156",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83609586030,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83872534365,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83918753542,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83504849988,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.031",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83888072816,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83370209023,3740,3118,,FindNextFileW,kernel32.dll,"00:55:05.968",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp") Found reference to API "83903354582,3740,3118,,FindNextFileW,kernel32.dll,"00:55:06.203",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002548.00000001.211598.02E10000.00000004.mdmp")39:T473,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "")3a:Tb1a,Dropped file: "_emoji_codes.py.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\_emoji_codes.py.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "argparse.py.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\argparse.py.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "test_win32file.cpython-311.pyc.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32\test\__pycache__\test_win32file.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "test_pprint.py.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pprint.py.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "test_pegen.py.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_peg_generator\test_pegen.py.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "scp.cpython-311.pyc.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32comext\adsi\demos\__pycache__\scp.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "default_styles.cpython-311.pyc.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\default_styles.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "_common.py.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\zoneinfo\_common.py.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "addressbook.acrodata.ni8pxbvnx" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "_mapping.cpython-311.pyc.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\pygments\formatters\__pycache__\_mapping.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "Krasnoyarsk.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Krasnoyarsk.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "network.xbm.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\bitmaps\network.xbm.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "iso2022_kr-utf8.txt.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\iso2022_kr-utf8.txt.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "test_ctypes.py.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_ctypes.py.ni8pxbvnx]- [targetUID: 00000000-00002548] Dropped file: "invalid-false-casing.toml.ni8pxbvnx" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tomllib\data\invalid\boolean\invalid-false-casing.toml.ni8pxbvnx]- [targetUID: 00000000-00002548]3b:T924,Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\_emoji_codes.py.ni8pxbvnx" has high entropy 7.998752156302656 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\argparse.py.ni8pxbvnx" has high entropy 7.9982283795882605 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32\test\__pycache__\test_win32file.cpython-311.pyc.ni8pxbvnx" has high entropy 7.996926490261487 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pprint.py.ni8pxbvnx" has high entropy 7.996405776111639 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_peg_generator\test_pegen.py.ni8pxbvnx" has high entropy 7.995323996730951 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32comext\adsi\demos\__pycache__\scp.cpython-311.pyc.ni8pxbvnx" has high entropy 7.991483883423365 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\default_styles.cpython-311.pyc.ni8pxbvnx" has high entropy 7.984385227354762 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\zoneinfo\_common.py.ni8pxbvnx" has high entropy 7.966260905213951 Dropped file "%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata.ni8pxbvnx" has high entropy 7.967724104461363 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\pygments\formatters\__pycache__\_mapping.cpython-311.pyc.ni8pxbvnx" has high entropy 7.9574105731215266 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Krasnoyarsk.ni8pxbvnx" has high entropy 7.922140434231874 Dropped file "%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.ni8pxbvnx" has high entropy 7.881583681540147 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\bitmaps\network.xbm.ni8pxbvnx" has high entropy 7.829052790267222 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\iso2022_kr-utf8.txt.ni8pxbvnx" has high entropy 7.728590297275205 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_ctypes.py.ni8pxbvnx" has high entropy 7.4843457794115285 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tomllib\data\invalid\boolean\invalid-false-casing.toml.ni8pxbvnx" has high entropy 7.2250828582952713c:T18b0,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft Office Outlook.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft Office Outlook.searchconnector-ms.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Searches\Microsoft OneNote.searchconnector-ms" to "%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms" to "%USERPROFILE%\Searches\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20231002\MicrosoftEdgeFavoritesBackup.html" to "%USERPROFILE%\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20231002\MicrosoftEdgeFavoritesBackup.html.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Favorites\Bing.url" to "%USERPROFILE%\Favorites\Bing.url.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Downloads\MicrosoftEdgeSetup.exe.xlzor0p.partial" to "%USERPROFILE%\Downloads\MicrosoftEdgeSetup.exe.xlzor0p.partial.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Downloads\npp.8.4.7.portable.x64.zip" to "%USERPROFILE%\Downloads\npp.8.4.7.portable.x64.zip.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\Database1.accdb" to "%USERPROFILE%\Documents\Database1.accdb.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook.pst.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook1.pst" to "%USERPROFILE%\Documents\Outlook Files\Outlook1.pst.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\Unfiled Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\Unfiled Notes.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\OneNote Guide.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one" to "%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" to "%APPDATA%\Mozilla\Firefox\profiles.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\extensions.json" to "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\extensions.json.ni8pxbvnx"3d:T1014,"BrowserMetrics-660D4992-1AB4.pma.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "_emoji_codes.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\_emoji_codes.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "xml.dom.html.ni8pxbvnx" has type "COM executable for MS-DOS"- [targetUID: 00000000-00002548] "argparse.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\argparse.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_win32file.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32\test\__pycache__\test_win32file.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_pprint.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_pprint.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_pegen.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_peg_generator\test_pegen.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "scp.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32comext\adsi\demos\__pycache__\scp.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "BCB4E4515F86FD37D2373B3343EFCD7C05DEE054.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "default_styles.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\rich\__pycache__\default_styles.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "80789A0D6B7949A2A953294DA06480D9C6588096.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "40348E1301B4D9D6A21D28CF158ADC6F982ABAD1.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "settings.dat.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "_common.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\zoneinfo\_common.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "addressbook.acrodata.ni8pxbvnx" has type "COM executable for MS-DOS"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata.ni8pxbvnx]- [targetUID: 00000000-00002548] "_mapping.cpython-311.pyc.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip\_vendor\pygments\formatters\__pycache__\_mapping.cpython-311.pyc.ni8pxbvnx]- [targetUID: 00000000-00002548] "Krasnoyarsk.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\Asia\Krasnoyarsk.ni8pxbvnx]- [targetUID: 00000000-00002548] "Microsoft OneNote.searchconnector-ms.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%USERPROFILE%\Searches\Microsoft OneNote.searchconnector-ms.ni8pxbvnx]- [targetUID: 00000000-00002548] "warnings.h.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "iso2022_jp_ext.py.ni8pxbvnx" has type "DOS executable (COM)"- [targetUID: 00000000-00002548] "network.xbm.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\bitmaps\network.xbm.ni8pxbvnx]- [targetUID: 00000000-00002548] "iso2022_kr-utf8.txt.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\iso2022_kr-utf8.txt.ni8pxbvnx]- [targetUID: 00000000-00002548] "test_ctypes.py.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_ctypes.py.ni8pxbvnx]- [targetUID: 00000000-00002548] "invalid-false-casing.toml.ni8pxbvnx" has type "DOS executable (COM)"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_tomllib\data\invalid\boolean\invalid-false-casing.toml.ni8pxbvnx]- [targetUID: 00000000-00002548]3e:Td5f,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\desktop.ini" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\AAAAAAAAAAA" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\BBBBBBBBBBB" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\CCCCCCCCCCC" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\DDDDDDDDDDD" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\EEEEEEEEEEE" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\FFFFFFFFFFF" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\GGGGGGGGGGG" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\HHHHHHHHHHH" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\IIIIIIIIIII" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\JJJJJJJJJJJ" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\KKKKKKKKKKK" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\LLLLLLLLLLL" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\MMMMMMMMMMM" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\NNNNNNNNNNN" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\OOOOOOOOOOO" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\PPPPPPPPPPP" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\QQQQQQQQQQQ" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\RRRRRRRRRRR" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\SSSSSSSSSSS" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\TTTTTTTTTTT" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\UUUUUUUUUUU" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\VVVVVVVVVVV" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\WWWWWWWWWWW" with delete access "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" opened "C:\$Recycle.Bin\S-1-5-18\XXXXXXXXXXX" with delete access3f:Tb09,"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addons.json.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\addonStartup.json.lz4.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\blocklist.xml.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cert9.db.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\compatibility.ini.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\containers.json.ni8pxbvnx" "a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\content-prefs.sqlite"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790963738221,"unified_at":"2026-10-02T17:55:38.221Z","metadata":{"hashes":{"sha256":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c","sha1":"1a3108ecb72ca0da0c04bd5c29caebee0ffd795d","md5":"c6c371198124b086a547407a7d36fcc6","sha512":"568da365e16e806593d5bb9ca335a4b1e7585148b29fe131d3fffb45275962991948de6700c28d3afb4302ebbb8570e20781933bdcfb3685cde325b64efc19d5","ssdeep":"1536:szICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDzp6HbSCkHdMBfusRDARJbWUyz:DqJogYkcSNm9V7Dzx19pODObWT","ssdeep_chunks":["1536:szICS4A","1536:zICS4AA","1536:ICS4AAw","1536:CS4AAwc","1536:S4AAwcz","1536:4AAwczU","1536:AAwczUU","1536:AwczUUf","1536:wczUUf8","1536:czUUf8y","1536:zUUf8y8","1536:UUf8y8g","1536:Uf8y8gv","1536:f8y8gvM","1536:8y8gvMH","1536:y8gvMH+","1536:8gvMH+1","1536:gvMH+1z","1536:vMH+1zG","1536:MH+1zGS","1536:H+1zGSN","1536:+1zGSNA","1536:1zGSNAo","1536:zGSNAoj","1536:GSNAojM","1536:SNAojMP","1536:NAojMP9","1536:AojMP95","1536:ojMP95D","1536:jMP95D1","1536:MP95D1x","1536:P95D1xD","1536:95D1xDz","1536:5D1xDzp","1536:D1xDzp6","1536:1xDzp6H","1536:xDzp6Hb","1536:Dzp6HbS","1536:zp6HbSC","1536:p6HbSCk","1536:6HbSCkH","1536:HbSCkHd","1536:bSCkHdM","1536:SCkHdMB","1536:CkHdMBf","1536:kHdMBfu","1536:HdMBfus","1536:dMBfusR","1536:MBfusRD","1536:BfusRDA","1536:fusRDAR","1536:usRDARJ","1536:sRDARJb","1536:RDARJbW","1536:DARJbWU","1536:ARJbWUy","1536:RJbWUyz","3072:szICS4A","3072:zICS4AA","3072:ICS4AAw","3072:CS4AAwc","3072:S4AAwcz","3072:4AAwczU","3072:AAwczUU","3072:AwczUUf","3072:wczUUf8","3072:czUUf8y","3072:zUUf8y8","3072:UUf8y8g","3072:Uf8y8gv","3072:f8y8gvM","3072:8y8gvMH","3072:y8gvMH+","3072:8gvMH+1","3072:gvMH+1z","3072:vMH+1zG","3072:MH+1zGS","3072:H+1zGSN","3072:+1zGSNA","3072:1zGSNAo","3072:zGSNAoj","3072:GSNAojM","3072:SNAojMP","3072:NAojMP9","3072:AojMP95","3072:ojMP95D","3072:jMP95D1","3072:MP95D1x","3072:P95D1xD","3072:95D1xDz","3072:5D1xDzp","3072:D1xDzp6","3072:1xDzp6H","3072:xDzp6Hb","3072:Dzp6HbS","3072:zp6HbSC","3072:p6HbSCk","3072:6HbSCkH","3072:HbSCkHd","3072:bSCkHdM","3072:SCkHdMB","3072:CkHdMBf","3072:kHdMBfu","3072:HdMBfus","3072:dMBfusR","3072:MBfusRD","3072:BfusRDA","3072:fusRDAR","3072:usRDARJ","3072:sRDARJb","3072:RDARJbW","3072:DARJbWU","3072:ARJbWUy","3072:RJbWUyz","1536:DqJogYk","1536:qJogYkc","1536:JogYkcS","1536:ogYkcSN","1536:gYkcSNm","1536:YkcSNm9","1536:kcSNm9V","1536:cSNm9V7","1536:SNm9V7D","1536:Nm9V7Dz","1536:m9V7Dzx","1536:9V7Dzx1","1536:V7Dzx19","1536:7Dzx19p","1536:Dzx19pO","1536:zx19pOD","1536:x19pODO","1536:19pODOb","1536:9pODObW","1536:pODObWT"],"imphash":"914685b69f2ac2ff61b6b0f1883a054d"},"file_info":{"file_name":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":150016,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1742312132000,"last_seen":1742365079000,"last_multi_scan":1742365079000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["lockbit","lockbitblack","criminal","ransomware","evasive"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":44},"sandbox_signatures":{"informative_count":75,"suspicious_count":18,"malicious_count":3,"total":96},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Ransomware/Win.LockBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.LockBit.ha","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/ZeroAccess.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.107474","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.BlackMatter-9970818-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_Win32_Lockbit_HA_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.107474 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.BlackMatter.M trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.LockBit.tr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059b9cd1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Lockbit.tsvY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BlackMatter!C6C371198124","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.jtarpu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/EncPk-HM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Agent.150016.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.DPTH-0027","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.ERVU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_44.9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.26935","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"suspicious","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Tries to steal Firefox browser credentials"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate services"},{"type":"suspicious","value":"Requested access to a system service"},{"type":"suspicious","value":"Calls an API typically used to retrieve the current status of the specified service"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Attempts to read Outlook-related files (file access)"},{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"malicious","value":"Renames many files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$25","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.207847853461279","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002548)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"OpenMutexW\" with parameter \"Global\\afc200360976321f509d43e70300f12a\" - (UID: 00000000-00002548)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_ShadowCopy\" (Indicator: \"select * from \"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\A17F22B67ECF9312BF59C8BB77445969BD6BBE61CF2B5BA98255F6CF30130D8C.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook1.pst\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$27","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002548)\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002548)\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002548)\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002548)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_ShadowCopy\" (Source: 00000000-00002548.00000000.209677.02E10000.00000004.mdmp, Indicator: \"select * from win32_shadowcopy\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:2548:168:WilStaging_02\"\n \"Local\\SM0:2548:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76A00000\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73280000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74770000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has an executable section named \".text\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has an executable section named \".itext\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has an writable section named \".data\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has an writable section named \".pdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" file has an entrypoint instructions - \"nop\t,nop\tword ptr [eax + eax],call\t0x419000,nop\tword ptr [eax + eax],call\t0x40639c,nop\tword ptr [eax + eax],call\t0x409960,nop\tword ptr [eax + eax],call\t0x4173b4,nop\tword ptr [eax + eax],push\t0,call\tdword ptr [0x4255c8],nop\tdword ptr [eax + eax],call\t0x418d28,call\t0x418d2e,call\t0x418d16,call\t0x418d1c,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\System32\\*.dll\" [Source: 00000000-00002548-00000C2C-1515765646]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BIT59EE.tmp.ni8pxbvnx\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" queries basic process information of the \"C:\\a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (UID: 2548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" trying to access non-existent file \"C:\\winspool.drv\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" trying to access non-existent file \"C:\\A17F22B67ECF9312BF59C8BB77445969BD6BBE61CF2B5BA98255F6CF30130D8C.EXE.LOCAL\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" trying to access non-existent file \"C:\\a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$33","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$34","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00002548\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLEEC29E357525D0F5A790A273997F7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"\\\\?\\%USERPROFILE%\\Documents\\Outlook Files\\ni8pxbvnx.README.txt\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00002548-00000C3B-6987081627\")\n Found string \"??\\C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook1.pst.ni8pxbvnx\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp\")\n Found string \"\\?\\C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook1.pst.ni8pxbvnx\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"LECT * FROM WIN32_SHADOWCOPY\" (Indicator: \" Win32_Shadowcopy\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_ShadowCopy\" (Indicator: \" Win32_Shadowcopy\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002548.00000000.209677.02E10000.00000004.mdmp, 00000000-00002548.00000001.211598.02E10000.00000004.mdmp, 00000000-00002548.00000002.213516.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$3a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has section name .text with entropy \"6.613530972543989\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has section name .data with entropy \"7.987233276034072\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has section name .pdata with entropy \"7.743907374492024\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" has section name .reloc with entropy \"6.728533295109\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$3b","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"$3c","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"OpenServiceW\" to access the \"vmicvss\" service\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"OpenServiceW\" to access the \"vmvss\" service\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"OpenServiceW\" to access the \"vss\" service","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$3d","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2717 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"0\"}\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"9\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"260\"\n \"lpBuffer\": \"C:\\\\\"}\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"0\"}\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"9\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate services","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"EnumServicesStatusExW\" with parameters {\"hSCManager\": \"2e2e838\"\n \"dwServiceType\": \"48\"\n \"dwServiceState\": \"3\"}","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-174","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetDriveTypeW\" with parameter \\\\?\\Volume{815ead30-0000-0000-0000-100000000000}\\ (UID: 00000000-00002548)\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002548)\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00002548)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve the current status of the specified service","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" called \"QueryServiceStatusEx\" with parameters {\"hService\": \"2e2e900\"\n \"InfoLevel\": \"0\"\n \"lpBuffer\": \"6158640\"\n \"cbBufSize\": \"36\"\n \"pcbBytesNeeded\": \"0\"}","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-170","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal Firefox browser credentials","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" trying to access file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\key4.db\"\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" trying to access file \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\key4.db\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-181","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-18\\ZZZZZZZZZZZ\" for deletion\n \"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\ZZZZZZZZZZZ\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" claimed CRC 188138 while the actual is CRC 180688","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetCommandLineA\n GetModuleHandleA\n GetCommandLineW\n GetProcAddress\n GetFileAttributesW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$3f","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames many files with double extensions (often indicator of ransomware infection)","description":"\"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe\" renames more than 100 files with extension \".sol.ni8pxbvnx\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":71,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":120,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["lockbit","lockbitblack","criminal","ransomware","evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"67da619689bf26257e024649","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe","analysis_start_time":"2025-03-19T06:17:59+00:00","indicators_count":{"informative":75,"suspicious":31,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}],"processes":[{"pid":2548,"ppid":0,"name":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe","command_line":"","sha256":"a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c","normalized_path":"C:\\a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c.exe","uid":"00000000-00002548","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["gdi32full.dll","netapi32.dll","dsuiext.dll","uxtheme.dll","msvcp_win.dll","sspicli.dll","cryptbase.dll","SHCore.dll","windows.storage.dll","wininet.dll","sechost.dll","mpr.dll","framedynos.dll","wow64win.dll","bcryptprimitives.dll","fltLib.dll","advapi32.dll","ntasn1.dll","wsock32.dll","oleaut32.dll","imm32.dll","cryptsp.dll","kernel.appcore.dll","samcli.dll","clbcatq.dll","user32.dll","userenv.dll","powrprof.dll","RstrtMgr.dll","win32u.dll","combase.dll","gpapi.dll","authz.dll","netutils.dll","activeds.dll","adsldpc.dll","IPHLPAPI.DLL","dsrole.dll","wbemcomn.dll","wbemsvc.dll","ntdll.dll","wow64cpu.dll","apphelp.dll","shell32.dll","fastprox.dll","msvcrt.dll","wow64.dll","rpcrt4.dll","gpedit.dll","wbemprox.dll","KernelBase.dll","ws2_32.dll","wtsapi32.dll","bcrypt.dll","srvcli.dll","logoncli.dll","Wldap32.dll","ntmarta.dll","ole32.dll","cfgmgr32.dll","comctl32.dll","kernel32.dll","shlwapi.dll","ncrypt.dll","wkscli.dll","gdi32.dll","ucrtbase.dll","VxSSL32.dll","profapi.dll","dssec.dll","ntdsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"addressbook.acrodata.ni8pxbvnx","sha256":"1de89f0ac39387635df07d1741aad212c1aaf8e45c68727cac760d62473eeba5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"argparse.py.ni8pxbvnx","sha256":"50b06f94ee4682d698275010d85ae1f86c5f0b1d90fc08dc6ed836fe5d981902","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"_mapping.cpython-311.pyc.ni8pxbvnx","sha256":"431ff918240c62d75794e7de8b60288d97319884ae5e4ddc7233436d4fdd1f6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"default_styles.cpython-311.pyc.ni8pxbvnx","sha256":"feddc4d0fd1da03f0f7e309774245c79c9f58431380cc5fe54f3bc6d570f3bf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"_emoji_codes.py.ni8pxbvnx","sha256":"62acb8be4427d63619de0e0404b606074c68acf6399172634e7ff18fa44914f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"test_win32file.cpython-311.pyc.ni8pxbvnx","sha256":"b7a4d5840f058d31209fcb481f39b8a9c5cc77fa9afa1e809210ecdab80ad766","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"scp.cpython-311.pyc.ni8pxbvnx","sha256":"5e9e95d5c1589a7b0403f9e78158f0fc1f06b49b7e4b87cc750d7db68d8cd627","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"iso2022_kr-utf8.txt.ni8pxbvnx","sha256":"2091be45adab1ad1534db2dad20e3058e6b989841a6a9f3fa7f8c1ab4940d987","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"test_ctypes.py.ni8pxbvnx","sha256":"52f95c995326de3f9ba071b3228c77f0578f0c93d246b1e3e1b2a7ace144c66b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"test_pegen.py.ni8pxbvnx","sha256":"312b60533bd560f6f1a32515ffbe179a7b2df3df362de2bd8b97a87d30b7b06f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"test_pprint.py.ni8pxbvnx","sha256":"67333f2784ebf9dcc346d352ea34014201654105b1293abf0404fb7c1b30bdad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"invalid-false-casing.toml.ni8pxbvnx","sha256":"3b63ed716ee0a3bd59710c34e761613880ff0d7494737ec2a9948be77a1aa98e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"_common.py.ni8pxbvnx","sha256":"85c2fe5f3cd3523a204b8536cfca5d635ec83b6a2a5f1dbddd35723a20cf0765","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"Krasnoyarsk.ni8pxbvnx","sha256":"11e569cbdca395a41dde0d645e4429fa34a4ec1e689af5c3b9b438719228c82f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"network.xbm.ni8pxbvnx","sha256":"0f8ef3586f2fb727442ad073b7801df24da4cc33157452ab93bc6fce4142249d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"Microsoft OneNote.searchconnector-ms.ni8pxbvnx","sha256":"f9e9bfe538234086d3dff9ef0f3e1aa968c0c845e54439a8a400fc380cf37d16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"BrowserMetrics-660D4992-1AB4.pma.ni8pxbvnx","sha256":"af1480056bd50cc2072a78364ef601fb798bd7ae13a9be25aed06ee3d74462c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"xml.dom.html.ni8pxbvnx","sha256":"20d5944f69a61576eed3f6854b3f0f88af82b769fb5fb59108c7098f876b8194","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"BCB4E4515F86FD37D2373B3343EFCD7C05DEE054.ni8pxbvnx","sha256":"4dfb1cde57e1132ae25b71ba7dc9bc5884103f8299cd4d139155417263f4346d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"80789A0D6B7949A2A953294DA06480D9C6588096.ni8pxbvnx","sha256":"f31da06ac8770f21172d29d4888e2b72a350d065b7393ecc86055ecaa24e2971","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\ni8pxbvnx.ico","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"C:\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"C:\\Users\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Videos\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Searches\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft Office Outlook.searchconnector-ms.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft OneNote.searchconnector-ms.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Saved Games\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Searches\\winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Pictures\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Pictures\\Saved Pictures\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Pictures\\Camera Roll\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\OneDrive\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Music\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\MicrosoftEdgeBackup20231002\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\MicrosoftEdgeBackups\\backups\\MicrosoftEdgeBackup20231002\\MicrosoftEdgeFavoritesBackup.html.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Links\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Favorites\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Favorites\\Bing.url.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Downloads\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Downloads\\MicrosoftEdgeSetup.exe.xlzor0p.partial.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Downloads\\npp.8.4.7.portable.x64.zip.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook1.pst.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\Unfiled Notes.one.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\Open Notebook.onetoc2.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\OneNote Guide.one.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Desktop\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Contacts\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\AppData\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Wireshark\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Wireshark\\recent.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Wireshark\\recent_common.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Wireshark\\profiles\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Sun\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Sun\\Java\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Sun\\Java\\Deployment\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\SystemExtensionsDev\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\addons.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\addonStartup.json.lz4.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\blocklist.xml.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\compatibility.ini.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cert9.db.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\containers.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\content-prefs.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\extensions.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\favicons.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\formhistory.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\handlers.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\key4.db.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\permissions.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\pkcs11.txt.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\pluginreg.dat.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\prefs.js.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\places.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\revocations.txt.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\search.json.mozlz4.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionCheckpoints.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\shield-preference-experiments.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\shield-recipe-client.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\SiteSecurityServiceState.txt.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\times.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\user.js.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\webappsstore.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\xulstore.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\toFetch\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\failed\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\toFetch\\tabs.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\weave\\failed\\tabs.json.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\temporary\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\.metadata.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\.metadata-v2.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1451318868ntouromlalnodry--epcr.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1657114595AmcateirvtiSty.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3561288849sdhlie.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3870112724rsegmnoittet-es.files\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3870112724rsegmnoittet-es.sqlite.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\3561288849sdhlie.files\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1657114595AmcateirvtiSty.files\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\storage\\permanent\\chrome\\idb\\1451318868ntouromlalnodry--epcr.files\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\previous.jsonlz4.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\recovery.baklz4.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\recovery.jsonlz4.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\sessionstore-backups\\upgrade.jsonlz4-20180206200532.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\057b56e5-3bf5-47d5-a0c6-299bafb55b4d.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\060851d8-e3cd-4b3b-bf31-953c9394bac3.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\minidumps\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\saved-telemetry-pings\\7c6a8b8f-5dfd-4881-b146-eb5af56f0eb4.ni8pxbvnx","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\gmp-widevinecdm\\ni8pxbvnx.README.txt","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:2548:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]},{"name":"Local\\SM0:2548:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67da619689bf26257e024649"}]}]}},"report_ids":{"sandbox_job_ids":["67da619689bf26257e024649"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample a17f22b67ecf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a17f22b67ecf…. Malware family: Trojan.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample a17f22b67ecf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a17f22b67ecf…. Malware family: Trojan.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a17f22b67ecf9312bf59c8bb77445969bd6bbe61cf2b5ba98255f6cf30130d8c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample a17f22b67ecf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a17f22b67ecf…. Malware family: Trojan.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]