26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample aed86670c850… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aed86670c850…. Malware family: Crifi.Generic. Threat score 100/100. 12/24 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb"],"about":{"@type":"SoftwareApplication","name":"8e0c9ab59a3841c5daa18c582162d1b8.bin.exe","applicationCategory":["peexe","executable"],"identifier":"aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":24},"behavioralIndicators":{"malicious":11,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T4eb,"" (Indicator: "MoveFileA"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found string "MoveFileWithProgressA" (Indicator: "MoveFileW"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp") Found string "MoveFileWithProgressW" (Indicator: "MoveFileW"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp")34:Te04,"" (Indicator: "WinExec"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00005636.00000001.96278.0040F000.00000002.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp")37:T13ce,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00001088.00000000.95362.030C0000.00000004.mdmp, 00000000-00001088.00000001.95778.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005636.00000000.96116.03350000.00000004.mdmp, 00000000-00005636.00000001.96278.03350000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp, 00000000-00006416.00000001.95037.02BC0000.00000004.mdmp") Found reference to API "MoveFileWithProgressA" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp") Found reference to API "MoveFileWithProgressW" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp") Found reference to API "MoveFileTransactedW" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp") Found reference to API "MoveFileTransactedA" (Indicator: "MoveFile"; Source: "00000000-00006416.00000000.94985.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006948.00000000.94830.033B0000.00000004.mdmp, 00000000-00006948.00000001.96287.033B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007312.00000000.94923.010E0000.00000004.mdmp, 00000000-00007312.00000001.95791.010E0000.00000004.mdmp")38:T4c5,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001088.00000000.95362.00ED5000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001088.00000000.95362.00ED5000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005636.00000001.96278.0040F000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00006416.00000000.94985.00995000.00000002.mdmp, 00000000-00006416.00000000.94985.0099D000.00000004.mdmp, 00000000-00006416.00000001.95037.0099D000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006416.00000000.94985.00995000.00000002.mdmp, 00000000-00006416.00000000.94985.0099D000.00000004.mdmp, 00000000-00006416.00000001.95037.0099D000.00000004.mdmp")39:T559,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "aed86670c850810895e663f1602d7d2b19b4f0b39062b313b7ecee68dfa385bb.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001088.00000000.95362.00ED5000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006416.00000000.94985.00995000.00000002.mdmp, 00000000-00006416.00000000.94985.0099D000.00000004.mdmp, 00000000-00006416.00000001.95037.0099D000.00000004.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006948.00000000.94830.00F8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006948.00000000.94830.00F8A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00007312.00000000.94923.00FEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007312.00000000.94923.00FEA000.00000002.mdmp")3a:T9a3,"stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005636.00000000.96116.03350000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005636.00000001.96278.03350000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005636.00000001.96278.03350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005636.00000001.96278.03350000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00005636.00000001.96278.03350000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00005636.00000001.96278.03350000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00005636.00000001.96278.03350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006948.00000001.96287.00F81000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00007312.00000001.95791.00FE1000.00000020.mdmp3b:T1541," Microsoft Corporation\"\n \"1wc13hv8.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"7dY1Bc44.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69bae5d51abf24ed150362cf"},{"report_type":"sandbox","report_id":"6a9e80cf3711d714750b2d7c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"