Telegram: Contact @r2d0s

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Genie8DN.Generic Sample ab8974c2f044… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab8974c2f044…. Malware family: Genie8DN.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","keywords":["Malicious","Genie8DN.Generic","malware analysis","sandbox report","threat intelligence","ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Genie8DN.Generic","antivirusDetections":{"malicious":18,"total":24},"behavioralIndicators":{"malicious":15,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tbc9,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=192512" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=256" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "AsyncCallback" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "longTimePattern" (Indicator: "time"; Source: "sample.bin"), Found reference to API "digitSubstitution isReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Select" (Indicator: "select"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Globalization.TextInfo%System.Globalization.NumberFormatInfo'System.Globalization.DateTimeFormatInfo&System.Globalization.GregorianCalendar" (Indicator: "time"; Source: "sample.bin"), Found reference to API "IAsyncResult" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "fullDateTimePattern" (Indicator: "time"; Source: "sample.bin"), Found reference to API "allLongTimePatterns m_eraNames" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeHelpers" (Indicator: "time"; Source: "sample.bin"), Found reference to API "'System.Globalization.DateTimeFormatInfo+" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Calendar+m_isReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "time"; Source: "sample.bin"), Found reference to API "dateTimeInfo" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "WriteLine" (Indicator: "write"; Source: "sample.bin"), Found reference to API "m_isReadOnly m_cultureName" (Indicator: "read"; Source: "sample.bin"), Found reference to API "m_isReadOnly m_cultureName" (Indicator: "rename"; Source: "sample.bin"), Found reference to API "shortTimePattern" (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), Found reference to API "System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "security"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin")28:T1128,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000153fa3c6932daf73e8ff1e00687d627790ef1f00705daf7369f30db5feffffffacee1f002248ae7350ee1f000000ad7548ef1f003b48ae73e0dfb27508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d8ee1f00000000000800000000000000000000000000000000000000000000000000ad757d3fa3c60000000018ef1f006992df76ffffffff34000000d8ee1f0008000000000000000000ad7548ef1f002794df76e0ee1f000b0000000000000030ef1f00 (UID: 00000000-00002480) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002480) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002480) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000090d11f0034d11f00226ec67500006504000000002d6ec67527f30c612d000000ecb76d74b8d11f0000004402b84a660200a463020d00000080000000f8d01f00000044027cd11f0070c8c775eb53df14feffffff2d000000d0cc7c74270000004cd11f00856ac8751c23cd758cd11f00f85fc87508000000bb69c775b269c7759ff30c612d000000ecb76d7427000000d0cc7c7460d11f002d000000d0cc7c742700000090d11f00856ac8751c23cd75d8d11f007e8a7b74ee8c7b74738a7b743d2525b52d000000ecb76d7427000000d0cc7c74e4276504782765043d2525b5a0d11f00fc52b9748cd21f00e0847b74dd058dc1feffffff738a7b74 (UID: 00000000-00002480) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002480) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008064) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008064)29:Tfa2,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002480) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002480) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008064) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008064) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008064) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008064)2a:T49de,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002480) "file.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002480) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008064) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008064)2b:Te7a,"file.exe" loaded module "KERNEL32" at base 75ec0000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76cf0000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76cf0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76cf0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75a00000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76cf0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76cf0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76cf0000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e90000 "file.exe" loaded module "ADVAPI32.DLL" at base 741e0000 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72dc0000 "file.exe" loaded module "SHLWAPI.DLL" at base 76030000 "file.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76010000 "file.exe" loaded module "VERSION.DLL" at base 73ec0000 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72610000 "file.exe" loaded module "USER32.DLL" at base 76fb0000 "file.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76cf0000 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "file.exe" loaded module "MSCOREE.DLL" at base 73b20000 "file.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 742e0000 "file.exe" loaded module "PSAPI.DLL" at base 759f0000 "file.exe" loaded module "KERNEL32.DLL" at base 75ec0000 "file.exe" loaded module "RPCRT4.DLL" at base 76ef0000 "file.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71130000 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "file.exe" loaded module "OLE32.DLL" at base 745b0000 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "file.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 742e0000 "file.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76cf0000 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 710a0000 "file.exe" loaded module "NTDLL.DLL" at base 77780000 "file.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "file.exe" loaded module "SHELL32.DLL" at base 746b0000 "file.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70640000 "file.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fe20000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 740f0000 "cmd.exe" loaded module "KERNEL32" at base 75ec0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76cf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76cf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76cf0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75a00000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76cf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76cf0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76cf0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73ae0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75ec0000 "cmd.exe" loaded module "NTDLL.DLL" at base 777800002c:T481,"file" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2d:Tb9e,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: file.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: file.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: file.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002480-00000C25-40140446] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002480-00000C25-40493477] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002480-00000C25-40623070] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002480-00000C25-40693054] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002480-00000C25-40834405] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002480-00000C25-40895081] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002480-00000C25-40945688] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002480-00000C25-41037616] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002480-00000C25-41202544] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002480-00000C25-41386246] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002480-00000C25-41582944] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002480-00000C25-41655035] Observed system executable string:"/c timeout /t 5 & del /f /q "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "%ALLUSERSPROFILE%\*.dll"" & exit" [Source: cmd.exe]2e:T645,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")2f:Ta09,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")30:T923,"file.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "file.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "file.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"31:T90c,"file.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002480) "file.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00002480) "file.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002480)32:T4d0,"file.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 892) "file.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 268) "file.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 916) "file.exe" wrote 00000400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 916) "file.exe" wrote 0001E800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 916) "file.exe" wrote 0000A200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 916) "file.exe" wrote 00001000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 916) "file.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 916) "file.exe" wrote 00005000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 916) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\timeout.exe" (Handle: 396)33:T54b,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004368.00000000.74572.01CB5000.00000040.mdmp, 00000000-00004368.00000000.74572.02CB0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004368.00000000.74572.01CB5000.00000040.mdmp, 00000000-00004368.00000000.74572.02CB0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004368.00000000.74572.01CB5000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004368.00000000.74572.01CB5000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004368.00000000.74572.01CB5000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp")34:T6da,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00001160.00000488.4880263.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00001160.00000488.4880263.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00001160.00000488.4880263.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "00001160.00000488.4880263.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp")35:Tff8,Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00001160-42407-13-00417770 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-13-00417770 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00001160-42407-37-0040F8DE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-126-0041795F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-126-0041795F Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00001160-42407-299-004190D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-299-004190D0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001160-42407-304-00417C00 Assembly shows XOR instruction xor ebx dword ptr [ecx] in Stream UID: 00000000-00001160-42407-304-00417C00 Assembly shows XOR instruction xor esi dword ptr [0042B1B0h] in Stream UID: 00000000-00001160-42407-307-004177D0 Assembly shows XOR instruction xor ecx dword ptr [eax+edi] in Stream UID: 00000000-00001160-42407-307-004177D0 Assembly shows XOR instruction xor ecx dword ptr [edx+edi] in Stream UID: 00000000-00001160-42407-307-004177D0 Assembly shows XOR instruction xor ecx dword ptr [ebp+0Ch] in Stream UID: 00000000-00001160-42407-325-0041BDB3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-348-00419A14 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-348-00419A14 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-355-004197E7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-355-004197E7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-359-00418B98 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-359-00418B98 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-360-0041A65A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-360-0041A65A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-363-00418AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-363-00418AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-364-0041A109 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-364-0041A109 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-373-00416F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-373-00416F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-376-00418DFB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-376-00418DFB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-385-0041747D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-385-0041747D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-387-0041753E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-387-0041753E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-395-00417E22 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-395-00417E22 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001160-42407-397-004180D4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001160-42407-397-004180D4 Assembly shows XOR instruction xor eax 0062C2C4h in Stream UID: 00000000-00001160-42407-494-004106F7 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001160-42407-589-004196F5 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00001160-42407-633-004196B0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00001160-42407-635-00417C9036:T486,"SELECT target_path, tab_url from downloads" (Source: 42407-169-00407898, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 42407-171-00408277, Indicator: "select service, encrypted_token from token_service") "Select * From AntiVirusProduct" (Source: 42407-235-0040F700, Indicator: "select * from antivirusproduct") "Select * From Win32_OperatingSystem" (Source: 42407-237-0040F577, Indicator: "select * from win32_operatingsystem") "Select * From Win32_OperatingSystem" (Source: 00000000-00004368.00000000.74572.02CB0000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "Select * From AntiVirusProduct" (Source: 00000000-00004368.00000000.74572.02CB0000.00000004.mdmp, Indicator: "select * from antivirusproduct") "SELECT target_path, tab_url from downloads" (Source: 00000000-00004368.00000000.74572.02CB0000.00000004.mdmp, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00004368.00000000.74572.02CB0000.00000004.mdmp, Indicator: "select service, encrypted_token from token_service")37:T7e4,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004368-00000C2B-170195755] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004368-00000C2B-171660869] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004368-00000C2B-171821551] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004368-00000C2B-172081431] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004368-00000C2B-172157610] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004368-00000C2B-172387094] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004368-00000C2B-173228451] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004368-00000C2B-173311570] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00004368-00000C2B-173596787] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004368-00000C2B-174127893] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004368-00000C2B-174222337] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00001160-00000C2B-179510756] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001160-00000C2B-180255133] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001160-00000C2B-180390413]38:T4a4,Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "00001160.00000488.4880263.00401000.wprm") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001160-00000C2C-176143362") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001160-00000C2C-176143471") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001160-00000C2C-176143690") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001160-00000C2C-176143794") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001160-00000C2C-176143904") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001160-00000C2C-176144010") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001160-00000C2C-178525060") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001160-00000C2C-178525420") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00004368.00000000.74572.02CB0000.00000004.mdmp")39:T26f5,"GET /r2d0s HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache" "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Mon, 07 Sep 2026 04:13:11 GMTContent-Type: text/html; charset=utf-8Content-Length: 9562Connection: keep-aliveSet-Cookie: stel_ssid=74722de624e85d3555_12594688625884419514; expires=Tue, 08 Sep 2026 04:13:11 GMT; path=/; samesite=None; secure; HttpOnlyPragma: no-cacheCache-control: no-storeX-Frame-Options: ALLOW-FROM https://web.telegram.orgContent-Security-Policy: frame-ancestors https://web.telegram.orgStrict-Transport-Security: max-age=35768000 Telegram: Contact @r2d0s link href="/css/myriad.css" rel="stylesheet"-->

Download

If you have Telegram, you can contact @r2d0s right away.

Send Message

WEBOGRAM_BTN --> PRIVACY_BTN -->

page generated in 5.79ms -->"3a:Td73,"ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Newman\* (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter 0b2f69b43a576b9edcc807a30872bd91 (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\*.* (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter 1033 (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter Accessibility.dll (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter AddInProcess.exe (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter AddInProcess.exe.config (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter AddInProcess32.exe (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter AddInProcess32.exe.config (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter AddInUtil.exe (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter AddInUtil.exe.config (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter AdoNetDiag.dll (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter adonetdiag.mof (UID: 00000000-00004368) "ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2.exe" called "FindNextFileW" with parameter adonetdiag.mof.uninstall (UID: 00000000-00004368)3b:T68e,Wrote 280 instructions to a remote process Wrote 2 instructions to a remote process Wrote 4 instructions to a remote process Wrote 36 instructions to a remote process Wrote 491 instructions to a remote process Wrote 20 instructions to a remote process Wrote 1 instructions to a remote process Wrote 11 instructions to a remote process Wrote 8 instructions to a remote process Wrote 14 instructions to a remote process Wrote 21 instructions to a remote process Wrote 92 instructions to a remote process Wrote 9 instructions to a remote process Wrote 34 instructions to a remote process Wrote 58 instructions to a remote process Wrote 18 instructions to a remote process Wrote 45 instructions to a remote process Wrote 24 instructions to a remote process Wrote 12 instructions to a remote process Wrote 50 instructions to a remote process Wrote 189 instructions to a remote process Wrote 15 instructions to a remote process Wrote 116 instructions to a remote process Wrote 10 instructions to a remote process Wrote 56 instructions to a remote process Wrote 26 instructions to a remote process Wrote 49 instructions to a remote process Wrote 61 instructions to a remote process Wrote 6 instructions to a remote process Wrote 17 instructions to a remote process Wrote 647 instructions to a remote process Wrote 31 instructions to a remote process Wrote 48 instructions to a remote process Wrote 162 instructions to a remote process Wrote 750 instructions to a remote process Wrote 53 instructions to a remote process Wrote 63 instructions to a remote process Wrote 120 instructions to a remote process Wrote 163 instructions to a remote process3c:T133c,Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") file/memory contains long string with (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199654112719_1_.htm") Found string "nk">View more info

V>F :n;lpd`()\nhvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x\"3`CM:k^nLuSvMxfx4qM?{i%CVl\\tP-`}v?@s)?hRQ>jB@H4-\" (Indicator: \"Oid\"; File: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003364.00000000.66307.00470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003364.00000000.66307.00470000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003364.00000000.66307.00470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003364.00000000.66307.00470000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"RegAsm.exe\" queries volume information of \"C:\\\" at 00000000-00003444-0000010C-14065565\n \"RegAsm.exe\" queries volume information of \"C:\\\" at 00000000-00003444-0000010C-16949208","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"\" (Indicator: \"twitter\"; File: \"76561199654112719_1_.htm\")\n Found string \"\" (Indicator: \"twitter\"; File: \"76561199654112719_1_.htm\")\n Found string \"\" (Indicator: \"twitter\"; File: \"76561199654112719_1_.htm\")\n Found string \"\" (Indicator: \"twitter\"; File: \"76561199654112719_1_.htm\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003444-00000C7E-12487442529\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"TarF8D0.tmp\" has type \"data\"\n \"CabF8CF.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 69211 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"file.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"file.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"RegAsm.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegGetValueA\" (Indicator: \"RegGetValue\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003364.00000000.66314.02A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"file.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"1b@ssl.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 69211 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- [targetUID: 00000000-00003364]\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- [targetUID: 00000000-00003364]\n \"CabF8CF.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 69211 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- [targetUID: 00000000-00003364]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"$3d","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"file.exe\" allocated memory in \"C:\\file.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"},{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"},{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"},{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]}],"intel_graph":{"map":{"Domain:steamcommunity.com":{"type":"Domain","value":"steamcommunity.com"},"Domain:t.me":{"type":"Domain","value":"t.me"},"File:389aa2497f7f8a4340e8a1f7e4f1b641067ffd2a60389fd4c0ea3ecbe163e225":{"type":"File","value":"389aa2497f7f8a4340e8a1f7e4f1b641067ffd2a60389fd4c0ea3ecbe163e225"},"File:443686c7cd3876da60bf42bca515418d5afa20d10626d75e76bf638b5e99fa0d":{"type":"File","value":"443686c7cd3876da60bf42bca515418d5afa20d10626d75e76bf638b5e99fa0d"},"File:84047f053a1cd0c79945cb916118eb11f522b7e1de11f2fd0aa184cb441ce156":{"type":"File","value":"84047f053a1cd0c79945cb916118eb11f522b7e1de11f2fd0aa184cb441ce156"},"File:a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22":{"type":"File","value":"a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22"},"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2":{"type":"File","value":"ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat VidarStealer"]}},"File:b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78":{"type":"File","value":"b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78"},"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d":{"type":"File","value":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},"File:ecb34eb7192870d2e407a30bc465b70359bdb402346fdc87751905d6612aa478":{"type":"File","value":"ecb34eb7192870d2e407a30bc465b70359bdb402346fdc87751905d6612aa478"},"Ip:116.202.5.172":{"type":"Ip","value":"116.202.5.172"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Ip:23.37.205.17":{"type":"Ip","value":"23.37.205.17"},"Ip:23.59.200.146":{"type":"Ip","value":"23.59.200.146"},"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21":{"type":"Threat","value":"VidarStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1546372618675944029","root":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat VidarStealer"]}},{"id":"1546372618675944028","root":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","edges":[{"edge_kind":"contacted_ip","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"Ip:23.59.200.146"},{"edge_kind":"contacted_ip","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"Ip:116.202.5.172"},{"edge_kind":"contacted_ip","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"Ip:23.37.205.17"},{"edge_kind":"contacted_ip","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_domain","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"Domain:steamcommunity.com"},{"edge_kind":"resolves_to","from_key":"Domain:steamcommunity.com","to_key":"Ip:23.59.200.146"},{"edge_kind":"contacted_domain","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"Domain:t.me"},{"edge_kind":"resolves_to","from_key":"Domain:t.me","to_key":"Ip:149.154.167.99"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","edges":[{"edge_kind":"extracted","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},{"edge_kind":"extracted","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"File:ecb34eb7192870d2e407a30bc465b70359bdb402346fdc87751905d6612aa478"},{"edge_kind":"extracted","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"File:b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78"},{"edge_kind":"extracted","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"File:a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22"},{"edge_kind":"extracted","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"File:84047f053a1cd0c79945cb916118eb11f522b7e1de11f2fd0aa184cb441ce156"},{"edge_kind":"extracted","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"File:389aa2497f7f8a4340e8a1f7e4f1b641067ffd2a60389fd4c0ea3ecbe163e225"},{"edge_kind":"extracted","from_key":"File:ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","to_key":"File:443686c7cd3876da60bf42bca515418d5afa20d10626d75e76bf638b5e99fa0d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":158,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","credentialharvesting","criminal","downloader","informationstealer","vidarstealer","evasive","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a9e39b76c9fc44a0f0b5ff2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Genie8DN.Generic","contacted_countries":["NLD","USA"],"submit_name":"ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","analysis_start_time":"2026-09-07T04:12:41+00:00","indicators_count":{"informative":138,"suspicious":28,"malicious":8},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"65fb1396fca1232ecb09cdd9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","USA"],"submit_name":"file","analysis_start_time":"2024-03-20T16:49:26+00:00","indicators_count":{"informative":74,"suspicious":14,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65fb1311327675395305e5d9","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU"],"submit_name":"file","analysis_start_time":"2024-03-20T16:47:14+00:00","indicators_count":{"informative":114,"suspicious":28,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.59.200.146","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"}]},{"address":"116.202.5.172","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"address":"23.37.205.17","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"}]},{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"}]}],"dns_resolutions":[{"domain":"steamcommunity.com","address":"23.59.200.146","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"},{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"}]},{"domain":"t.me","address":"149.154.167.99","ttl":43,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"}],"processes":[{"pid":2480,"ppid":0,"name":"file.exe","command_line":"","sha256":"ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2","normalized_path":"C:\\file.exe","uid":"00000000-00002480","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7196,"ppid":2480,"name":"RegAsm.exe","command_line":"","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00000000-00002480","uid":"00000000-00007196"},{"pid":7888,"ppid":2480,"name":"RegAsm.exe","command_line":"","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00000000-00002480","uid":"00000000-00007888"},{"pid":7980,"ppid":2480,"name":"RegAsm.exe","command_line":"","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00000000-00002480","uid":"00000000-00007980"},{"pid":8064,"ppid":7980,"name":"cmd.exe","command_line":"/c timeout /t 5 & del /f /q \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" & del \"%ALLUSERSPROFILE%\\*.dll\"\" & exit","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007980","uid":"00000000-00008064"},{"pid":4020,"ppid":8064,"name":"timeout.exe","command_line":"timeout /t 5","sha256":"35a2d2fc8f5b0baf4dbc489acd24229c0092ff56def50aa3e0043626bc25117f","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00000000-00008064","uid":"00000000-00004020"}],"all_imported_dlls":["msvcp_win.dll","AcLayers.dll","IPHLPAPI.DLL","ntasn1.dll","rasadhlp.dll","cryptsp.dll","pcacli.dll","cryptbase.dll","oleaut32.dll","version.dll","ucrtbase_clr0400.dll","psapi.dll","SHCore.dll","wininet.dll","winnsi.dll","sspicli.dll","advapi32.dll","powrprof.dll","dnsapi.dll","dpapi.dll","cryptnet.dll","ncryptsslp.dll","clrjit.dll","uxtheme.dll","wbemdisp.dll","mscoree.dll","win32u.dll","ncrypt.dll","mswsock.dll","FWPUCLNT.DLL","sechost.dll","vcruntime140_clr0400.dll","shell32.dll","System.ni.dll","iertutil.dll","gdi32.dll","clr.dll","mpr.dll","nsi.dll","msIso.dll","mskeyprotect.dll","wow64.dll","gdi32full.dll","msvcrt.dll","shlwapi.dll","crypt32.dll","wbemsvc.dll","aepic.dll","wow64cpu.dll","mscoreei.dll","sfc_os.dll","wintrust.dll","cldapi.dll","propsys.dll","ntdll.dll","imm32.dll","bcrypt.dll","wow64win.dll","fltLib.dll","cfgmgr32.dll","GdiPlus.dll","imagehlp.dll","clbcatq.dll","wbemprox.dll","apphelp.dll","bcryptprimitives.dll","ole32.dll","combase.dll","dbghelp.dll","sxs.dll","kernel32.dll","rpcrt4.dll","mscorlib.ni.dll","windows.storage.dll","profapi.dll","Windows.StateRepositoryPS.dll","VxSSL32.dll","kernel.appcore.dll","System.Core.ni.dll","RstrtMgr.dll","winhttp.dll","urlmon.dll","schannel.dll","rsaenh.dll","user32.dll","KernelBase.dll","ucrtbase.dll","setupapi.dll","wbemcomn.dll","fastprox.dll","ntmarta.dll","edputil.dll","ws2_32.dll","sfc.dll","msasn1.dll","OnDemandConnRouteHelper.dll","gpapi.dll","webio.dll","vcruntime140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","usp10.dll","lpk.dll","api-ms-win-core-localization-l1-2-0.dll","samcli.dll","normaliz.dll","credssp.dll","ntdsapi.dll","api-ms-win-crt-runtime-l1-1-0.dll","winmm.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wbemcomn2.dll","nlssorting.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msvcp140.dll","dhcpcsvc6.dll","api-ms-win-crt-time-l1-1-0.dll","netprofm.dll","npmproxy.dll","api-ms-win-crt-string-l1-1-0.dll","msacm32.dll","AcGenral.dll","devobj.dll","wshqos.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wship6.dll","msctf.dll","api-ms-win-crt-environment-l1-1-0.dll","tzres.dll","dhcpcsvc.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-math-l1-1-0.dll","userenv.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","rpcss.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","nlaapi.dll","comctl32.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","secur32.dll","dwmapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","WSHTCPIP.DLL","RpcRtRemote.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","devrtl.dll","SensApi.dll","Wldap32.dll","cabinet.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"file.exe.log","sha256":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"}]},{"name":"H3I70500.txt","sha256":"ecb34eb7192870d2e407a30bc465b70359bdb402346fdc87751905d6612aa478","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"}]},{"name":"CabF8CF.tmp","sha256":"b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"TarF8D0.tmp","sha256":"a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"84047f053a1cd0c79945cb916118eb11f522b7e1de11f2fd0aa184cb441ce156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"76561199654112719_1_.htm","sha256":"389aa2497f7f8a4340e8a1f7e4f1b641067ffd2a60389fd4c0ea3ecbe163e225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"443686c7cd3876da60bf42bca515418d5afa20d10626d75e76bf638b5e99fa0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log","sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"}]},{"name":"Local\\SM0:2480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fb1396fca1232ecb09cdd9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9e39b76c9fc44a0f0b5ff2"},{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65fb1311327675395305e5d9"}]}]}},"report_ids":{"sandbox_job_ids":["6a9e39b76c9fc44a0f0b5ff2","65fb1396fca1232ecb09cdd9","65fb1311327675395305e5d9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Genie8DN.Generic Sample ab8974c2f044… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ab8974c2f044…. Malware family: Genie8DN.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2"}],["$","meta","4",{"property":"og:title","content":"Malicious Genie8DN.Generic Sample ab8974c2f044… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ab8974c2f044…. Malware family: Genie8DN.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ab8974c2f044c18e8fa26abe5d1fcd702f15e5a91f04b560ff6dbcfe6ce060d2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Genie8DN.Generic Sample ab8974c2f044… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ab8974c2f044…. Malware family: Genie8DN.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3e","11",{}]]