24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDownloader_Win32_Malgent_MSR Sample ae282aecde2e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ae282aecde2e…. Malware family: TrojanDownloader_Win32_Malgent_MSR. Threat score 100/100. 5/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1","keywords":["Malicious","TrojanDownloader_Win32_Malgent_MSR","malware analysis","sandbox report","threat intelligence","ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1"],"about":{"@type":"SoftwareApplication","name":"Hotel_Agreement.scr","applicationCategory":["peexe","64bits","executable"],"identifier":"ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanDownloader_Win32_Malgent_MSR","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T98c,Found reference to "HashAlgorithm:" (Indicator: "HashAlgorithm"; File: "Hotel_Agreement.bin") Found reference to "MSRC2wrap" (Indicator: "RC2"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to "CDH_STD_SHA384_KDF" (Indicator: "SHA384"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to "HashAlgorithmId" (Indicator: "HashAlgorithm"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to "ECCurve: {Oid}" (Indicator: "Oid"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to "Target;M:System.Security.Cryptography.CryptoConfigForwarder.#cctorT" (Indicator: "CryptoConfig"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to "AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to "s_serverAuthOid" (Indicator: "Oid"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to "s_clientAuthOid" (Indicator: "Oid"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to "OidCollection" (Indicator: "Oid"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to "OidCollection" (Indicator: "OidCollection"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to "Aes192" (Indicator: "Aes"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to "Aes256" (Indicator: "Aes"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to "Aes128" (Indicator: "Aes"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to "HashAlgorithmType" (Indicator: "HashAlgorithm"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp, 00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to "get_HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp")26:T5ae,Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00170000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.001A0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00450000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.005B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.005D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.3FB70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp")27:T7be,".exe" called "RtlGetVersion" (UID: 00000000-00003924) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000060a0abfdfe07000060c6a704000000000001dc02000000001082cc03000000006f00740065006c005f00410067007200650065006d0065006e0074002e006500c07e4900000000000000000000000000bc80490000000000208549000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c803057700000000000000000000000040000000000000000000490000000000a0b2abfdfe0700003000000000000000b80249000000000048ddf8760000000000000000000000003000000000000000d9009a00 (UID: 00000000-00003924) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000307cd80300000000d0b5a704000000000000490000000000e88cf876000000000000000000000000107cd703000000003b17000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100000000000000000000000000003b17000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924)28:Ta40,".exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")29:Ta67,".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2a:T58a,".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")2b:T1203,".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter C:\ws2_32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter C:\sspicli.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter C:\Normaliz.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter C:\ucrtbase.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter C:\crypt32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter C:\user32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter DEVRTL.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter sspicli.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter Normaliz.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter ucrtbase.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003924) ".exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003924)2c:T4ac6,".exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatus (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter IdnToAscii (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SetupIterateCabinetW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter DevRtlGetThreadLogToken (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter NdrClientCall3 (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003924) ".exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003924)2d:T440,Found reference to API "g____PInvoke|10_0" (Indicator: "CreateProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "CreateProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API "StartWithCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "CreateProcessWT" (Indicator: "CreateProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "CreateProcessWithLogonWT" (Indicator: "CreateProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp")2e:T574,Found reference to API "Failed to map file. CreateFileW(%s) failed with error %d" (Indicator: "CreateFile"; File: "Hotel_Agreement.bin") Found reference to API "Failed to map file. CreateFileMappingW(%s) failed with error %d" (Indicator: "CreateFile"; File: "Hotel_Agreement.bin") Found reference to API "InvalidOperation_CantCreateFileMapping" (Indicator: "CreateFile"; File: "Hotel_Agreement.bin") Found reference to API "nvalidOperation_CantCreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "CreateFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "g____PInvoke|1_0" (Indicator: "CreateFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "CreateFileMappingWT" (Indicator: "CreateFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp")2f:T36ce,Found reference to API (Indicator: "WinHttpOpen"; File: "Hotel_Agreement.bin") Found reference to API (Indicator: "EncryptMessage"; File: "Hotel_Agreement.bin") Found reference to API (Indicator: "AcquireCredentialsHandleW"; File: "Hotel_Agreement.bin") Found reference to API (Indicator: "CloseHandle"; File: "Hotel_Agreement.bin") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003924.00000000.78685.00170000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00003924.00000000.78685.00170000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.005E0000.00000002.mdmp, 00000000-00003924.00000000.78685.007A0000.00000002.mdmp, 00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupNames2"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "LsaClose"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "LsaFreeReturnBuffer"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "LsaNtStatusToWinError"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupSids"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "LsaOpenPolicy"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "LsaFreeMemory"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "ReadConsole"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found reference to API (Indicator: "WriteConsole"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "GetComputerName"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.005E0000.00000002.mdmp, 00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectory"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to API (Indicator: "GetPerAdapterInfo"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to API (Indicator: "GetNetworkParams"; Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMapping"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.43000000.00000004.mdmp") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp")30:Tba5,Found reference to API "UseShellExecuteNotSupported" (Indicator: "ShellExecute"; File: "Hotel_Agreement.bin") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00170000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "seShellExecuteNotSupported$" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "seShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "gThe Process object must have the UseShellExecute property set to false in order to redirect IO streams." (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to start a process as a user." (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "mThe Process object must have the UseShellExecute property set to false in order to use environment variables." (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "NThe FileName property should not be a directory unless UseShellExecute is set." (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "2UseShellExecute is not supported on this platform." (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "g____PInvoke|19_0" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "ShellExecuteOnSTAThread" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "get_UseShellExecuteNotSupported" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "k__BackingField" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "get_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "ShellExecuteFunction" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "ShellExecuteHelper" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "StartWithShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp")31:T41c,".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\sspicli.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\Normaliz.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\ucrtbase.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\crypt32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\user32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "C:\ws2_32.dll" - [base:0; Status:c0000135]32:Tfbd,".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 ".exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 ".exe" loaded module "OLE32.DLL" at base fdc60000 ".exe" loaded module "OLEAUT32.DLL" at base fde80000 ".exe" loaded module "RPCRT4.DLL" at base fd780000 ".exe" loaded module "C:\SSPICLI.DLL" at base 0 ".exe" loaded module "C:\NORMALIZ.DLL" at base 0 ".exe" loaded module "C:\UCRTBASE.DLL" at base 0 ".exe" loaded module "NCRYPT.DLL" at base fc5a0000 ".exe" loaded module "C:\CRYPT32.DLL" at base 0 ".exe" loaded module "CRYPT32.DLL" at base fce60000 ".exe" loaded module "C:\USER32.DLL" at base 0 ".exe" loaded module "USER32.DLL" at base 76d20000 ".exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base fd8c0000 ".exe" loaded module "GPAPI.DLL" at base fbed0000 ".exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base fd8c0000 ".exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base fd8c0000 ".exe" loaded module "CRYPTSP.DLL" at base fc420000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fc120000 ".exe" loaded module "ADVAPI32.DLL" at base fdad0000 ".exe" loaded module "CRYPTBASE.DLL" at base fca90000 ".exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base f8970000 ".exe" loaded module "CRYPTNET.DLL" at base f8970000 ".exe" loaded module "SENSAPI.DLL" at base f58a0000 ".exe" loaded module "SHLWAPI.DLL" at base fd9f0000 ".exe" loaded module "WINHTTP.DLL" at base f7df0000 ".exe" loaded module "NTDLL.DLL" at base 76f40000 ".exe" loaded module "PROFAPI.DLL" at base fcc30000 ".exe" loaded module "DNSAPI.DLL" at base fc240000 ".exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76e20000 ".exe" loaded module "CABINET.DLL" at base f2bf0000 ".exe" loaded module "DEVRTL.DLL" at base fbef0000 ".exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base fd8c0000 ".exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base fd8c0000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f7ed0000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "KERNEL32" at base 76e20000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 ".exe" loaded module "NSI.DLL" at base ff1d0000 ".exe" loaded module "CFGMGR32.DLL" at base fcd70000 ".exe" loaded module "C:\WS2_32.DLL" at base 0 ".exe" loaded module "WS2_32.DLL" at base fd3c0000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fc3c0000 ".exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base fc3b0000 ".exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fbd00000 ".exe" loaded module "IPHLPAPI.DLL" at base fbe40000 ".exe" loaded module "RASADHLP.DLL" at base f9d40000 ".exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base fa1d0000 ".exe" loaded module "SSPICLI.DLL" at base fca00000 ".exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base fc1b0000 ".exe" loaded module "NORMALIZ.DLL" at base 77100000 ".exe" loaded module "UCRTBASE.DLL" at base f4af0000 ".exe" loaded module "SECUR32.DLL" at base fc760000 ".exe" loaded module "USERENV.DLL" at base fcdb0000 ".exe" loaded module "SETUPAPI.DLL" at base fd41000033:T4ae,"14001500000000002854d2f4fe070000@CRYPT32.dll" "14001500000000004054d2f4fe070000@CRYPT32.dll" "0c000d00000000005854d2f4fe070000@ADVAPI32.dll" "0c000d00000000006854d2f4fe070000@ADVAPI32.dll" "0e000f00000000007854d2f4fe070000@ADVAPI32.dll" "0d000e00000000008854d2f4fe070000@BCrypt.dll" "0d000e0000000000a854d2f4fe070000@BCrypt.dll" "0f00100000000000b854d2f4fe070000@BCrypt.dll" "1300140000000000c854d2f4fe070000@BCrypt.dll" "0e000f00000000009055d2f4fe070000@winhttp.dll" "1200130000000000b055d2f4fe070000@winhttp.dll" "1200130000000000c855d2f4fe070000@winhttp.dll" "1600170000000000e055d2f4fe070000@winhttp.dll" "1800190000000000f855d2f4fe070000@RPCRT4.dll" "13001400000000002856d2f4fe070000@RPCRT4.dll" "14001500000000004056d2f4fe070000@RPCRT4.dll" "16001700000000005856d2f4fe070000@RPCRT4.dll" "0b000c0000000000704ed2f4fe070000@WS2_32.dll" "110012000000000090941ffcfe070000@secur32.dll" "0d000e00fe070000e03bd2f4fe070000@IPHLPAPI.DLL" "0f001000fe070000183cd2f4fe070000@IPHLPAPI.DLL" "0c000d00fe070000383cd2f4fe070000@IPHLPAPI.DLL" "15001600fe0700006834d2f4fe070000@ADVAPI32.dll" "0e000f00fe070000e834d2f4fe070000@ADVAPI32.dll" "0e000f00fe0700002035d2f4fe070000@ADVAPI32.dll"34:T64b,".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: ""; Value: "")35:Td5e,".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "SEARCHLIST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")36:T8a7,".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "C:\api-ms-win-crt-string-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll" ".exe" trying to touch file "C:\ucrtbase.DLL" ".exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" ".exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" ".exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" ".exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" ".exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" ".exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" ".exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll" ".exe" trying to touch file "C:\api-ms-win-crt-stdio-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll" ".exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" ".exe" trying to touch file "C:\api-ms-win-crt-convert-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll" ".exe" trying to touch file "C:\api-ms-win-crt-heap-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll"37:T7df,".exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" ".exe" trying to access non-existent file "C:\ucrtbase.DLL" ".exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" ".exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" ".exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL"38:T6c6,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "Hotel_Agreement.bin") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003924-00000C26-38036138") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003924-00000C26-40699329") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003924-00000C26-40702459") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003924-00000C26-40702459") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003924-00000C26-40702459") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003924-00000C26-41531113") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003924-00000C26-41531113") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003924-00000C26-41784576") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003924-00000C26-86357297") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003924-00000C26-90866916") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003924-00000C26-90869785") Found reference to API "g____PInvoke|185_0" (Indicator: "WinHttpOpen"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.43000000.00000004.mdmp")39:T670,Found reference to API "System.Net.WebClient" (Indicator: "System.Net.WebClient"; File: "Hotel_Agreement.bin") Found reference to API "System.Net.WebClient.dll" (Indicator: "System.Net.WebClient"; File: "Hotel_Agreement.bin") Found reference to API "System.Net.WebClient" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.78685.00170000.00000002.mdmp, 00000000-00003924.00000000.78685.00190000.00000002.mdmp, 00000000-00003924.00000000.78685.00610000.00000002.mdmp, 00000000-00003924.00000000.78685.E0580000.00000004.mdmp") Found reference to API "System.Net.WebClient.dll" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp, 00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found reference to API "_System.Net.WebClient is not supported on this platform. Use System.Net.Http.HttpClient instead." (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp, 00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found reference to API "FxResources.System.Net.WebClient.SR.resources" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp, 00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found reference to API "FxResources.System.Net.WebClient" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp, 00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found reference to API ":\System.Net.WebClient.dll" (Indicator: "System.Net.WebClient"; Source: "00000000-00003924.00000000.78685.02100000.00000004.mdmp")3a:T776,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "Hotel_Agreement.bin") Found reference to API "aCannot re-call BeginGetRequestStream/BeginGetResponse while a previous call is still in progress." (Indicator: "BeginGetRequestStream"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to API "aCannot re-call BeginGetRequestStream/BeginGetResponse while a previous call is still in progress." (Indicator: "GetRequestStream"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found reference to API "g____PInvoke|185_0" (Indicator: "WinHttpOpen"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "g____PInvoke|186_0" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "g____PInvoke|207_0" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "g____PInvoke|208_0" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.43000000.00000004.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp")3b:T663,Heuristic match: "System.GC.Name" Pattern match: "https://aka.ms/dotnet/download" Pattern match: "https://aka.ms/dotnet/info" Pattern match: "https://aka.ms/dotnet/app-launch-failedTo" Pattern match: "https://aka.ms/dotnet/sdk-not-found" Pattern match: "https://aka.ms/dotnet-core-applaunch" Pattern match: "https://aka.ms/dotnet/app-launch-failedWould" Heuristic match: "%$&$*)+),+-)/.0.1.213141516.7.8798:9;9<9=9>9?9@9A.B.GF" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Heuristic match: "dbdesing.com" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Heuristic match: "ctldl.windowsupdate.com" Pattern match: "dbdesing.com/wp-content/uploads/2023/03/levelcomputer.zip" Pattern match: "https://learn.microsoft.com/en-us/windows/win32/sbscs/application-manifests" Pattern match: "https://github.com/dotnet/runtime" Pattern match: "https://aka.ms/dotnet-warnings/{0" Pattern match: "schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid" Pattern match: "https://aka.ms/binaryformatter" Heuristic match: "SH;.MS" Pattern match: "https://aka.ms/dotnet-illink/com" Pattern match: "https://aka.ms/dotnet-warnings/{0}6"3c:T2c14,Found URL "https://learn.microsoft.com/en-us/windows/win32/sbscs/application-manifests" - Source: "00000000-00003924.00000000.78685.00170000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00003924.00000000.78685.00190000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.001A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00003924.00000000.78685.001A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.00450000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00003924.00000000.78685.00450000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00003924.00000000.78685.00460000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found URL "https://aka.ms/dotnet-illink/com)$00000001-0000-0000-c000-000000000046kthe" - Source: "00000000-00003924.00000000.78685.005B0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.005B0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00003924.00000000.78685.005B0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.005D0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00003924.00000000.78685.005D0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00003924.00000000.78685.00610000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00003924.00000000.78685.007A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows!this" - Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found URL "http://gzip," - Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows" - Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found URL "https://aka.ms/dotnet/downloadlearn" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://aka.ms/dotnet/info" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-foundfailed" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?architecture:" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedwould" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found URL "http://http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0g6rnb^0^!(yxbsdp" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@wo)" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found URL "http://www.microsoft.com0mpa<9:'*" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0[-forq[k<<]/z0h" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/windows/win32/sbscs/application-manifests" - Source: "00000000-00003924.00000000.78685.40339000.00000002.mdmp")3d:Td61,Found string "Available HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Pending HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string ", Total associated HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Max HTTP/1.1 connection limit:" (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "No available HTTP/1.1 connections; request queued." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Found expired HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Found invalid HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Found usable HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Disposing HTTP/1.1 connection return to pool. Connection lifetime expired." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Dequeued waiting HTTP/1.1 request." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Discarding signaled HTTP/1.1 request waiter from queue." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Discarding canceled HTTP/1.1 request from queue." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Put HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Server does not support HTTP2; disabling HTTP2 use and proceeding with HTTP/1.1 connection" (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "Downgrading queued HTTP2 request to HTTP/1.1" (Indicator: "HTTP/1.1"; File: "Hotel_Agreement.bin") Found string "DOnly HTTP/1.0 and HTTP/1.1 version requests are currently supported." (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found string "DOnly HTTP/1.0 and HTTP/1.1 version requests are currently supported." (Indicator: "HTTP/1.0"; Source: "00000000-00003924.00000000.78685.005E0000.00000002.mdmp") Found string "vailable HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "ending HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "Total associated HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "ax HTTP/1.1 connection limit:" (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "o available HTTP/1.1 connections; request queued." (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "ound expired HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "ound invalid HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "ound usable HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp") Found string "isposing HTTP/1.1 connection return to pool. Connection lifetime expired." (Indicator: "HTTP/1.1"; Source: "00000000-00003924.00000000.78685.01F10000.00000002.mdmp")3e:Tdc4,Found string "EnableAES" (Indicator: "aes"; File: "Hotel_Agreement.bin") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "Hotel_Agreement.bin") Found string "System.IO.Compression.ZipFile.dll" (Indicator: "zipfile"; File: "Hotel_Agreement.bin") Found string "GZipStream" (Indicator: "GzipStream"; File: "Hotel_Agreement.bin") Found string "net_http_parser_invalid_base64_string" (Indicator: "base64"; File: "Hotel_Agreement.bin") Found string "Format_BadBase64Char" (Indicator: "base64"; File: "Hotel_Agreement.bin") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00003924.00000000.78685.00170000.00000002.mdmp, 00000000-00003924.00000000.78685.00480000.00000002.mdmp, 00000000-00003924.00000000.78685.E0580000.00000004.mdmp") Found string "MS3DESwrap" (Indicator: "3des"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "SAES_OAEP" (Indicator: "aes"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "ha1ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "ha256ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "ha384ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "ha512ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "pecifiedECDSA" (Indicator: "ecdsa"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "icrosoft Base DSS and Diffie-Hellman Cryptographic Provider" (Indicator: "diffie-hellman"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "icrosoft Enhanced DSS and Diffie-Hellman Cryptographic Provider" (Indicator: "diffie-hellman"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.005E0000.00000002.mdmp, 00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.E0710000.00000004.mdmp") Found string "System.Security.Cryptography.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "RSA2" (Indicator: "rsa2"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "Target;M:System.Security.Cryptography.CryptoConfigForwarder.#cctorT" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found string "System.IO.Compression.ZipFile.dll" (Indicator: "zipfile"; Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found string "FxResources.System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found string "FxResources.System.IO.Compression.ZipFile.SR.resources" (Indicator: "zipfile"; Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp") Found string "ZipFileExtensions" (Indicator: "zipfile"; Source: "00000000-00003924.00000000.78685.00480000.00000002.mdmp")3f:T9d3,Found reference to API "g____PInvoke|0_0" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|0_0" (Indicator: "OpenProcessToken"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|1_0" (Indicator: "GetTokenInformation"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|2_0" (Indicator: "GetTokenInformation"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|5_0" (Indicator: "LsaLookupNames"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|7_0" (Indicator: "LsaLookupSids"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "LsaLookupNames2T" (Indicator: "LsaLookupNames"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "LsaLookupSidsT" (Indicator: "LsaLookupSids"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|6_0" (Indicator: "OpenProcessToken"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp")40:T5c6,Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "Hotel_Agreement.bin") Found reference to API "g____PInvoke|25_0" (Indicator: "CheckTokenMembership"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|7_0" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "g____PInvoke|9_0" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API "LookupPrivilegeValueWT" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003924.00000000.78685.00590000.00000002.mdmp")41:T712,Found reference to API "g____PInvoke|20_0" (Indicator: "RevertToSelf"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|21_0" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|1_0" (Indicator: "GetTokenInformation"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|2_0" (Indicator: "GetTokenInformation"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|4_0" (Indicator: "DuplicateToken"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "g____PInvoke|4_0" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003924.00000000.78685.00430000.00000002.mdmp")42:Tb33,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "SEARCHLIST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")43:Tbc5,".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")44:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3d3d3d3d3d3d3AAAAAAAH////////////9wAAAAAAB/////////////cAAAAAAAf4iIiIiIiIiIj3AAAAAAAH////////////9wAAAAABERERERERERERERERAAAAAZmZmZmZmZmZmZmZkQAAAAGZmZmZmZmZmZmZmZEAAAABmX+ZmX//iZmImZmRAAAACZl/mZl/mYiZiJmZkQAAAAmZf5mZf5l/mYiZmZEAAAAJmX//iX+Zn3mP+JmRAAAACZl/l/l/mX+ZiJmZkQAAAAmZf5f3f5mPmYiZmZEAAAAJmX//iX//iZmP/5mRAAAACZmZmZmZmZmZmZmZkQAAAAmZmZmZmZmZmZmZmZEAAAABmZmZmRERERERERERAAAAAAf////////////3AAAAAAAH////////////9wAAAAAACPiIiIiIiIiIiPcAAAAAAAj/////////+Ij3AAAAAAAI/////////4d3dwAAAAAACPiIiIiIiI+P/4cAAAAAAAj/////////j/93AAAAAAAI/////////4/4cAAAAAAACP////////+PhwAAAAAAAAiIiIiHd3d3eHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////gAAD/4AAA/+AAAP/gAAD/4AAA/4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/gAAD/4AAA/+AAAP/gAAD/4AAA/+AAAP/gAAD/4AAB/+AAA//gAAf///////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790524483340,"unified_at":"2026-09-27T15:54:43.340Z","metadata":{"hashes":{"sha256":"ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1","sha1":"937d7a5e6ebf8b80f601e73f572d2669432bf8c4","md5":"f46e69b3181544ebd365ac7bcac3b5c7","sha512":"25fdafd3c651852a8a0b785f74ac1af4b221b66ba0a2d7e97cff29b228772285f4919c3c1165a3b7e70fe7e716b98fd44e587b9a2524f1a0d39a04782b91f6c2","ssdeep":"196608:dsox4dT4cSgSi0t3GZcCBkbGUnUmvPSJGZKTZZclE:eoux4cSVaZcf7KTZZV","ssdeep_chunks":["196608:dsox4dT","196608:sox4dT4","196608:ox4dT4c","196608:x4dT4cS","196608:4dT4cSg","196608:dT4cSgS","196608:T4cSgSi","196608:4cSgSi0","196608:cSgSi0t","196608:SgSi0t3","196608:gSi0t3G","196608:Si0t3GZ","196608:i0t3GZc","196608:0t3GZcC","196608:t3GZcCB","196608:3GZcCBk","196608:GZcCBkb","196608:ZcCBkbG","196608:cCBkbGU","196608:CBkbGUn","196608:BkbGUnU","196608:kbGUnUm","196608:bGUnUmv","196608:GUnUmvP","196608:UnUmvPS","196608:nUmvPSJ","196608:UmvPSJG","196608:mvPSJGZ","196608:vPSJGZK","196608:PSJGZKT","196608:SJGZKTZ","196608:JGZKTZZ","196608:GZKTZZc","196608:ZKTZZcl","196608:KTZZclE","393216:dsox4dT","393216:sox4dT4","393216:ox4dT4c","393216:x4dT4cS","393216:4dT4cSg","393216:dT4cSgS","393216:T4cSgSi","393216:4cSgSi0","393216:cSgSi0t","393216:SgSi0t3","393216:gSi0t3G","393216:Si0t3GZ","393216:i0t3GZc","393216:0t3GZcC","393216:t3GZcCB","393216:3GZcCBk","393216:GZcCBkb","393216:ZcCBkbG","393216:cCBkbGU","393216:CBkbGUn","393216:BkbGUnU","393216:kbGUnUm","393216:bGUnUmv","393216:GUnUmvP","393216:UnUmvPS","393216:nUmvPSJ","393216:UmvPSJG","393216:mvPSJGZ","393216:vPSJGZK","393216:PSJGZKT","393216:SJGZKTZ","393216:JGZKTZZ","393216:GZKTZZc","393216:ZKTZZcl","393216:KTZZclE","196608:eoux4cS","196608:oux4cSV","196608:ux4cSVa","196608:x4cSVaZ","196608:4cSVaZc","196608:cSVaZcf","196608:SVaZcf7","196608:VaZcf7K","196608:aZcf7KT","196608:Zcf7KTZ","196608:cf7KTZZ","196608:f7KTZZV"],"imphash":"68031a2b11c02bee00a0a687110994be"},"file_info":{"file_name":"Hotel_Agreement.scr","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":13963119,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1692971608000,"last_seen":1693619620000,"last_multi_scan":1693619620000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":122,"suspicious_count":18,"malicious_count":2,"total":142},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Agent.ucbyh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABDownloader.WTZQ-7479","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.MSIL.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3593199","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDownloader_Win32_Malgent_MSR","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"},{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.007A0000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"g____PInvoke|0_0\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|18_0\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|6_0\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"g____PInvoke|9_0\" (Indicator: \"FreeMemory\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|4_0\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"AttemptSetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00003924.00000000.78685.00480000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: Hotel_Agreement.bin","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$26","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-3924; Source: \"00000000-00003924.00000000.78685.00490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003924-28370-2-4010D5AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"Hotel_Agreement.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"'{0}' not selected because it doesn't have a private key.\" (Indicator: \"private key\"; File: \"Hotel_Agreement.bin\")\n Found string \"Private Key]\" (Indicator: \"private key\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found string \"Public Key]\" (Indicator: \"public key\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found string \"C PRIVATE KEY\" (Indicator: \"private key\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found string \"SA PRIVATE KEY\" (Indicator: \"private key\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found string \"{0}' not selected because it doesn't have a private key.\" (Indicator: \"private key\"; Source: \"00000000-00003924.00000000.78685.005E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" (UID: 00000000-00003924)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003924)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100000000000060c6a704000000000030fdffff0700000000a7fdfe0700001082cc0300000000000000000000000002000000000000000000000000000000d410a7fdfe0700000000faffff0700000030fdffff07000060c6a704000000001f0000000000000089ceddfcfe0700000000faff (UID: 00000000-00003924)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; File: \"Hotel_Agreement.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; Source: \"00000000-00003924.00000000.78685.007A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"ThrowGetVersionException\" (Indicator: \"GetVersion\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.212.71.243:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"IO_CannotCreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"Hotel_Agreement.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003924.00000000.78685.00480000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Hotel_Agreement.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00003924-28370-12-40111B5C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"k__BackingField\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"get_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"g____PInvoke|18_0\" (Indicator: \"OpenThread\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"g____PInvoke|0_0\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|24_0\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|6_0\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"GetOrOpenProcessHandle\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.005E0000.00000002.mdmp, 00000000-00003924.00000000.78685.007A0000.00000002.mdmp, 00000000-00003924.00000000.78685.01F10000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"Hotel_Agreement.bin\" contains export function called \"CLRJitAttachState\" at ordinal 3\n \"Hotel_Agreement.bin\" contains export function called \"DotNetRuntimeInfo\" at ordinal 4\n \"Hotel_Agreement.bin\" contains export function called \"MetaDataGetDispenser\" at ordinal 5\n \"Hotel_Agreement.bin\" contains export function called \"g_CLREngineMetrics\" at ordinal 2\n \"Hotel_Agreement.bin\" contains export function called \"g_dacTable\" at ordinal 6","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: Hotel_Agreement.bin\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: Hotel_Agreement.bin\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: Hotel_Agreement.bin\n \"SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: Hotel_Agreement.bin\n \"SOFTWARE\\Classes\\\" in Source: Hotel_Agreement.bin\n \"HKCU\\\" in Source: Hotel_Agreement.bin\n \"HKLM\\\" in Source: Hotel_Agreement.bin\n \"SOFTWARE\\dotnet\" in Source: Hotel_Agreement.bin\n \"SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.3\\Server\" in Source: Hotel_Agreement.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Hotel_Agreement.bin\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-3924","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FC570000\n \".exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FC060000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FD780000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Hotel_Agreement.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Hotel_Agreement.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Hotel_Agreement.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Hotel_Agreement.bin\" has an executable section named \".text\"\n \"Hotel_Agreement.bin\" has an executable section named \".CLR_UEF\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Hotel_Agreement.bin\" has an writable section named \".data\"\n \"Hotel_Agreement.bin\" has an writable section named \".didat\"\n \"Hotel_Agreement.bin\" has an writable section named \"Section\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Hotel_Agreement.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x14059d984,add\trsp, 0x28,jmp\t0x14059d40c,int3\t,int3\t,and\tdword ptr [rip + 0x1db29d], 0,ret\t,mov\tqword ptr [rsp + 8], rbx,push\trbp,lea\trbp, [rsp - 0x4c0],sub\trsp, 0x5c0,mov\tebx, ecx,mov\tecx, 0x17,call\tqword ptr [rip + 0x57092],test\teax, eax,je\t0x14059d5d6,mov\tecx, ebx,int\t0x29,mov\tecx, 3,call\t0x14059d5a4,xor\tedx, edx,lea\trcx, [rbp - 0x10],mov\tr8d, 0x4d0,call\t0x14059f3a0,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x5f1800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x17cc00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x14de00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x5f174c\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x17cb76\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x14ddac\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"Hotel_Agreement.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"dbdesing.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\en-US\\tzres.dll.mui\" [Source: 00000000-00003924-00000C25-38434651]\n Observed system executable string:\"%WINDIR%\\system32\\cryptnet.dll\" [Source: 00000000-00003924-00000C25-39812200]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 43:EC:64:FB:3D:06:C5:74:24:ED:E3:6F:55:9C:2A:88:16:9D:C0:0E; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CabDC4E.tmp\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\TarDC4F.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"levelcomputer.zip\" has type \"Zip archive data at least v1.0 to extract\"- Location: [%TEMP%\\levelcomputer.zip]- [targetUID: 00000000-00003924]\n \"TarDC4F.tmp\" has type \"data\"- Location: [%TEMP%\\TarDC4F.tmp]- [targetUID: 00000000-00003924]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003924]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003924]\n \"CabDC4E.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\CabDC4E.tmp]- [targetUID: 00000000-00003924]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"TarDC4F.tmp\" has type \"data\" - Location: [%TEMP%\\TarDC4F.tmp]\n \"CabDC4E.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\" - Location: [%TEMP%\\CabDC4E.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \".exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\cabdc4e.tmp\"\n \".exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tardc4f.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}\"\n \".exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}\"\n \".exe\" trying to access non-existent file \"\\Device\\RasAcd\"\n \".exe\" trying to access non-existent file \"C:\\CabDC4E.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\cabdc4e.tmp\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tardc4f.tmp\"\n \"Hotel_Agreement.exe\" writes file \"%temp%\\levelcomputer.zip\"\n \"Hotel_Agreement.exe\" writes file \"%temp%\\tardc4f.tmp\"\n \"Hotel_Agreement.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"Hotel_Agreement.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"Hotel_Agreement.exe\" writes file \"%temp%\\cabdc4e.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\".exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"3d4d8f0\"\n \"lpszHeaders\": \"If-None-Match: \\\"071e15c5dc4d71:0\\\"If-Modified-Since: Mon, 18 Oct 2021 20:18:50 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\".exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3d4d8f0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"g____PInvoke|67_0\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"CreatePipeWithSecurityAttributes\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"handle:{0}, setsockopt():{1}\" (Indicator: \"setsockopt\"; File: \"Hotel_Agreement.bin\")\n Found reference to API \"handle:{0} setsockopt():{1}\" (Indicator: \"setsockopt\"; File: \"Hotel_Agreement.bin\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"$39","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"185.212.71.243\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003924)\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00003924)\n \".exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00003924)\n \".exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00003924)\n \".exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00003924)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"g____PInvoke|0_0\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessToken\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp, 00000000-00003924.00000000.78685.00590000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp\")\n Found reference to API \"g____PInvoke|25_0\" (Indicator: \"EnumProcesses\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"K32EnumProcesses\" (Indicator: \"EnumProcesses\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"K32EnumProcessesT\" (Indicator: \"EnumProcesses\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003924.00000000.78685.007A0000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddressesFlags\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003924.00000000.78685.007A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"g____PInvoke|5_0\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"LsaLookupNames2T\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"Failed to map file. GetFileSizeEx(%s) failed with error %d\" (Indicator: \"GetFileSize\"; File: \"Hotel_Agreement.bin\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00003924.00000000.78685.00170000.00000002.mdmp\")\n Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00003924.00000000.78685.005E0000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"g____PInvoke|35_0\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"GetProcessIdFromHandle\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"GetProcessIds\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariablesBlock\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"g____PInvoke|25_0\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00003924.00000000.78685.00170000.00000002.mdmp, 00000000-00003924.00000000.78685.00430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"jStarting a process as another user with a specified password and domain is not supported on this platform.\" (Indicator: \"password\"; Source: \"00000000-00003924.00000000.78685.00590000.00000002.mdmp\")\n Found string \"=Invalid URI: The username:password construct is badly formed.\" (Indicator: \"password\"; Source: \"00000000-00003924.00000000.78685.005B0000.00000002.mdmp\")\n Found string \"_password\" (Indicator: \"password\"; Source: \"00000000-00003924.00000000.78685.005B0000.00000002.mdmp, 00000000-00003924.00000000.78685.007A0000.00000002.mdmp\")\n Found string \":SOCKS server requested username & password authentication.\" (Indicator: \"password\"; Source: \"00000000-00003924.00000000.78685.01F10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Hotel_Agreement.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003924.00000000.78685.00490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"g____PInvoke|21_0\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00003924.00000000.78685.00430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003924.00000000.78685.005E0000.00000002.mdmp\")\n Found reference to API \"RemoveDirectory\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003924.00000000.78685.005E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown by transport\" (Indicator: \"shutdown \") in Source: Hotel_Agreement.bin\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003924.00000000.78685.007A0000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003924.00000000.78685.01F10000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; File: \"Hotel_Agreement.bin\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003924.00000000.78685.00460000.00000002.mdmp, 00000000-00003924.00000000.78685.40164000.00000002.mdmp, 00000000-00003924.00000000.78685.40339000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetSidSubAuthority\" which can \"Returns a pointer to a specified subauthority in a security identifier (SID)\" [Source: Hotel_Agreement.bin]\n Observed import api \"GetSidSubAuthorityCount\" which can \"Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: Hotel_Agreement.bin]\n Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: Hotel_Agreement.bin]\n Observed import api \"RevertToSelf\" which can \"Terminates the impersonation of a client application\" [Source: Hotel_Agreement.bin]\n Observed import api \"SetKernelObjectSecurity\" which can \"Sets the security of a kernel object\" [Source: Hotel_Agreement.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003924]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003924]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3924)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".didat with unusual entropies 0.426930319415","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\".exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003924)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/71 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"t@f9.t\"\n Pattern match: \"9@9a.b.gf\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Hotel_Agreement.bin\" has resource with unusual entropy \"RT_ICON:7.85189477943\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"Hotel_Agreement.exe\" writes archive file \"%TEMP%\\levelcomputer.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.3.3.7\"\n \"7.0.0.0\"\n \"127.0.0.1\"\n Potential IP \"1.3.3.7\" found in string \"otel_Agreement/1.3.3.7\"\n \"27.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.212.71.243 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CabDC4E.tmp\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\TarDC4F.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CabDC4E.tmp\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\TarDC4F.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$43","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\169\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\169\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\QAGENTRT.DLL,-10\"; Value: \"System Health Authentication\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\169\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\FVEUI.DLL,-843\"; Value: \"BitLocker Drive Encryption\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\169\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\FVEUI.DLL,-844\"; Value: \"BitLocker Data Recovery Agent\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\169\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\WUAUENG.DLL,-400\"; Value: \"Windows Update\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003924]\n \"CabDC4E.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\CabDC4E.tmp]- [targetUID: 00000000-00003924]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"Hotel_Agreement.bin\" has a TLS callback with entrypoint at 0x4059cb30\n \"Hotel_Agreement.bin\" has a TLS callback with entrypoint at 0x1\n \"Hotel_Agreement.bin\" has a TLS callback with entrypoint at 0x4059d1e0","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n SetKernelObjectSecurity\n MapViewOfFileEx\n UnhandledExceptionFilter\n GetThreadContext\n GetTempPathW\n ConnectNamedPipe\n OutputDebugStringW\n VirtualAllocExNuma\n OutputDebugStringA\n GetModuleFileNameW\n LoadLibraryA\n LoadLibraryExA\n LoadLibraryExW\n CreateThread\n DisconnectNamedPipe\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetTickCount\n VirtualProtect\n GetFileSize\n CreateDirectoryW\n GetProcAddress\n CreateFileMappingW\n WriteFile\n GetFileSizeEx\n FindNextFileW\n CreateFileMappingA\n FindFirstFileExW\n CreateFileW\n IsDebuggerPresent\n CreateFileA\n GetSystemInfo\n SleepEx\n GetCommandLineW\n SleepConditionVariableSRW\n GetTickCount64\n CreateThreadpoolTimer\n MapViewOfFile\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessW\n Sleep\n VirtualAlloc\n ShellExecuteW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"WinHttpOpen\" (Source: Hotel_Agreement.bin, API is part of module: WINHTTP.DLL)\n Found string \"accept\" (Source: Hotel_Agreement.bin, API is part of module: WS2_32.DLL)\n Found string \"SspiEncodeStringsAsAuthIdentity\" (Source: Hotel_Agreement.bin, API is part of module: SSPICLI.DLL)\n Found string \"EncryptMessage\" (Source: Hotel_Agreement.bin, API is part of module: SSPICLI.DLL)\n Found string \"AcquireCredentialsHandleW\" (Source: Hotel_Agreement.bin, API is part of module: SSPICLI.DLL)\n Found string \"socket\" (Source: Hotel_Agreement.bin, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"Hotel_Agreement.bin\" has a section named \".CLR_UEF\"\n \"Hotel_Agreement.bin\" has a section named \".didat\"\n \"Hotel_Agreement.bin\" has a section named \"Section\"\n \"Hotel_Agreement.bin\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"Hotel_Agreement.bin has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (DLL) (GUI) x86-64\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":13,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":13,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64e8b256d2996aa20c0b5e14","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Heur","contacted_countries":["DEU"],"submit_name":"Hotel_Agreement.scr","analysis_start_time":"2023-08-25T13:53:28+00:00","indicators_count":{"informative":122,"suspicious":35,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.212.71.243","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}],"dns_resolutions":[{"domain":"dbdesing.com","address":"185.212.71.243","ttl":14400,"country":"Germany","registrar_name":"OwnRegistrar, Inc.","registrar_name_servers":"NS1.DNS-PARKING.COM","registrar_creation_date":"2022-03-26T23:18:28+00:00","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}],"processes":[{"pid":3924,"ppid":0,"name":"Hotel_Agreement.exe","command_line":"","sha256":"ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1","normalized_path":"C:\\Hotel_Agreement.exe","uid":"00000000-00003924","icon":"$44"}],"all_imported_dlls":["api-ms-win-crt-math-l1-1-0.dll","msctf.dll","wuaueng.dll","wship6.dll","kernel32.dll","dnsapi.dll","fveui.dll","ws2_32.dll","webio.dll","ncrypt.dll","cryptsp.dll","Wldap32.dll","sechost.dll","gdi32.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","winhttp.dll","credssp.dll","FWPUCLNT.DLL","ucrtbase.dll","setupapi.dll","mswsock.dll","WSHTCPIP.DLL","secur32.dll","profapi.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","bcrypt.dll","ntdll.dll","imm32.dll","crypt32.dll","gpapi.dll","ole32.dll","advapi32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-time-l1-1-0.dll","rsaenh.dll","rpcrt4.dll","api-ms-win-crt-environment-l1-1-0.dll","dhcpcsvc.dll","SensApi.dll","cabinet.dll","msvcrt.dll","user32.dll","shlwapi.dll","fltLib.dll","devrtl.dll","bcryptprimitives.dll","cfgmgr32.dll","rasadhlp.dll","api-ms-win-core-synch-l1-2-0.dll","winnsi.dll","sspicli.dll","userenv.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","VxSSL64.dll","schannel.dll","cryptnet.dll","msasn1.dll","lpk.dll","usp10.dll","api-ms-win-crt-locale-l1-1-0.dll","dhcpcsvc6.dll","oleaut32.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","nsi.dll","cryptbase.dll","IPHLPAPI.DLL","QAGENTRT.DLL","shell32.dll","api-ms-win-crt-runtime-l1-1-0.dll","devobj.dll","KernelBase.dll","normaliz.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"CabDC4E.tmp","sha256":"6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"name":"TarDC4F.tmp","sha256":"bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"name":"levelcomputer.zip","sha256":"9f59fa8bfc22e7f8eeb0aabf9ccea130eecd3a825822abd5e8e5347ba0c1402d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,static","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"path":"%TEMP%\\levelcomputer.zip","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64e8b256d2996aa20c0b5e14"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64e8b256d2996aa20c0b5e14"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious TrojanDownloader_Win32_Malgent_MSR Sample ae282aecde2e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ae282aecde2e…. Malware family: TrojanDownloader_Win32_Malgent_MSR. Threat score 100/100. 5/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDownloader_Win32_Malgent_MSR Sample ae282aecde2e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ae282aecde2e…. Malware family: TrojanDownloader_Win32_Malgent_MSR. Threat score 100/100. 5/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ae282aecde2e74cadc73ee114e6760959686dc5ee99c608e5e4047766b5137d1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDownloader_Win32_Malgent_MSR Sample ae282aecde2e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ae282aecde2e…. Malware family: TrojanDownloader_Win32_Malgent_MSR. Threat score 100/100. 5/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]