Current IP Check

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample af4962cafb50… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample af4962cafb50…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 4/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6"],"about":{"@type":"SoftwareApplication","name":"FEDEX - 2716436747964836.exe","applicationCategory":["peexe","executable"],"identifier":"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T593,Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp28:T6db,Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp29:T421,Observed string:"frombase64string" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"frombase64string" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]2a:T4b3,Observed string:"CryptUnprotectData" which can perform decryption and does an integrity check of the data. [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"CryptUnprotectData" which can perform decryption and does an integrity check of the data. [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]2b:T41d,Observed string:"description="Uses CryptProtectData and CrypY" which can performs encryption on the data. [Source: 00000000-00003864.00000000.66692.00820000.00000004.mdmp], Observed string:"iption="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" which can performs encryption on the data. [Source: 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp], Observed string:"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" which can performs encryption on the data. [Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp, 00000000-00003864.00000002.70532.02390000.00000004.mdmp], Observed string:"description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" which can performs encryption on the data. [Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp]2c:T457,Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp2d:T42f,Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp2e:T932,Observed api:"FindWindow"[Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin] Observed api:"FindWindow"[Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp] Observed api:"GetWindowText"[Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed api:"GetForegroundWindow"[Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed api:"GetWindowText"[Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp] Observed api:"GetForegroundWindow"[Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]2f:T7ad,"nkqpbn.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "ENABLEDHCP"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTRATIONENABLED"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTERADAPTERNAME"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DOMAIN"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DHCPDOMAIN"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "nkqpbn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")30:T5bb,Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "CreateFileW" (Indicator: "CreateFile") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "CreateFileW" (Indicator: "CreateFile") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "CreateFileW" (Indicator: "CreateFile") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "CreateFileW" (Indicator: "CreateFile") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp31:T5af,Observed string: "ShellExecuteExW" (Indicator: "ShellExecute") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "ShellExecuteExW" (Indicator: "ShellExecute") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "set_UseShellExecute" (Indicator: "ShellExecute") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "set_UseShellExecute" (Indicator: "ShellExecute") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp32:T6bf,Observed string: "MoveFileExW" (Indicator: "MoveFile") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "MoveFileW" (Indicator: "MoveFile") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "MoveFileW" (Indicator: "MoveFile") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "MoveFileExW" (Indicator: "MoveFile") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "MoveFileExW" (Indicator: "MoveFile") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "MoveFileExW" (Indicator: "MoveFile") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp33:T8d9,Observed string: "GetCommandLineA" (Indicator: "GetCommandLine") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetCommandLineW" (Indicator: "GetCommandLine") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetCommandLineW" (Indicator: "GetCommandLine") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "GetCommandLineA" (Indicator: "GetCommandLine") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetCommandLineW" (Indicator: "GetCommandLine") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "CommandLineToArgvW" (Indicator: "CommandLineToArgv") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "GetCommandLineA" (Indicator: "GetCommandLine") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "GetCommandLineW" (Indicator: "GetCommandLine") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp Observed string: "CommandLineToArgvW" (Indicator: "CommandLineToArgv") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp Observed string: "GetCommandLineA" (Indicator: "GetCommandLine") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp34:T55b,Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "OpenProcessToken" (Indicator: "OpenProcess") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "GetProcessHeap" (Indicator: "GetProcessHeap") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp35:T87f,Observed string: "GetLastError" (Indicator: "GetLastError") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "GetLastError" (Indicator: "GetLastError") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp Observed string: "SetLastError" (Indicator: "SetLastError") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp36:T534,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003576.00000000.66377.00310000.00000002.mdmp 00000000-00003576.00000000.66377.00880000.00000004.mdmp 00000000-00003576.00000001.66567.008BF000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003576.00000000.66377.00310000.00000002.mdmp 00000000-00003576.00000000.66377.00880000.00000004.mdmp 00000000-00003576.00000001.66567.008BF000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003576.00000000.66377.00880000.00000004.mdmp 00000000-00003576.00000001.66567.008BF000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003576.00000000.66377.00880000.00000004.mdmp 00000000-00003576.00000001.66567.008BF000.00000004.mdmp37:T728,Observed keyword:".Run" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00003864.00000000.66692.00178000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00003864.00000000.66692.02390000.00000004.mdmp 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp]38:T5bb,"FEDEX-2716436747964836.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73c90000 "FEDEX-2716436747964836.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "FEDEX-2716436747964836.exe" loaded module "KERNEL32" at base 76540000 "FEDEX-2716436747964836.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "FEDEX-2716436747964836.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 74a50000 "FEDEX-2716436747964836.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72ee0000 "FEDEX-2716436747964836.exe" loaded module "CRYPTBASE.DLL" at base 748c0000 "FEDEX-2716436747964836.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741b0000 "FEDEX-2716436747964836.exe" loaded module "SETUPAPI.DLL" at base 76650000 "FEDEX-2716436747964836.exe" loaded module "RPCRT4.DLL" at base 75f80000 "FEDEX-2716436747964836.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76bd0000 "FEDEX-2716436747964836.exe" loaded module "PROFAPI.DLL" at base 76c20000 "FEDEX-2716436747964836.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 72e40000 "FEDEX-2716436747964836.exe" loaded module "DWMAPI.DLL" at base 74190000 "FEDEX-2716436747964836.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74140000 "FEDEX-2716436747964836.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73df0000 "FEDEX-2716436747964836.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 73fb000039:T569,"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x3f4,push ebx,push esi,push edi,push 0x20,pop edi,xor ebx, ebx,push 0x8001,mov dword ptr [ebp - 0x14], ebx,mov dword ptr [ebp - 4], 0x40a230,mov dword ptr [ebp - 0x10], ebx,call dword ptr [0x4080c8],mov esi, dword ptr [0x4080cc],lea eax, [ebp - 0x140],push eax,mov dword ptr [ebp - 0x12c], ebx,mov dword ptr [ebp - 0x2c], ebx,mov dword ptr [ebp - 0x28], ebx,mov dword ptr [ebp - 0x140], 0x11c,call esi,test eax, eax,jne 0x4036ca,lea eax, [ebp - 0x140],mov dword ptr [ebp - 0x140], 0x114,push eax," "nkqpbn.exe" file has an entrypoint instructions - "call 0x406278,jmp 0x401d40,push ebp,mov ebp, esp,sub esp, 8,mov dword ptr [ebp - 4], edi,mov dword ptr [ebp - 8], esi,mov esi, dword ptr [ebp + 0xc],mov edi, dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],shr ecx, 7,jmp 0x401ee8,lea ebx, [ebx],movdqa xmm0, xmmword ptr [esi],movdqa xmm1, xmmword ptr [esi + 0x10],movdqa xmm2, xmmword ptr [esi + 0x20],movdqa xmm3, xmmword ptr [esi + 0x30],movdqa xmmword ptr [edi], xmm0,movdqa xmmword ptr [edi + 0x10], xmm1,movdqa xmmword ptr [edi + 0x20], xmm2,movdqa xmmword ptr [edi + 0x30], xmm3,movdqa xmm4, xmmword ptr [esi + 0x40],movdqa xmm5, xmmword ptr [esi + 0x50],movdqa xmm6, xmmword ptr [esi + 0x60],movdqa xmm7, xmmword ptr [esi + 0x70],"3a:T5b9,"FEDEX-2716436747964836.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "FEDEX-2716436747964836.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "FEDEX-2716436747964836.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "FEDEX-2716436747964836.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "nkqpbn.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "nkqpbn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG")3b:Ta26,Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "LoadLibrary" (Indicator: "LoadLibrary") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp Observed string: "LoadLibrary" (Indicator: "LoadLibrary") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp3c:T4cb,"FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nkqpbn.exe" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\FLTLIB.DLL" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\TRUSTEDINSTALLER.EXE" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\NKQPBN.EXE" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL"3d:T598,"FEDEX-2716436747964836.exe" trying to access non-existent file "C:\FEDEX-2716436747964836.exe.Local\" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\kyqxwbxje.vza" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\zrfsjy.gui" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\FEDEX-2716436747964836.EXE.LOCAL" "FEDEX-2716436747964836.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\KYQXWBXJE.VZA" "nkqpbn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nkqpbn.exe.Local\" "nkqpbn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\NKQPBN.EXE.LOCAL" "nkqpbn.exe" trying to access non-existent file "C:\Windows\SysWOW64\mscoree.dll.local" "nkqpbn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\NKQPBN.EXE.CONFIG" "nkqpbn.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "nkqpbn.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "nkqpbn.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\SYSTEM.WEB.EXTENSIONS.INI" "nkqpbn.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL"3e:T1cc0,Heuristic match: "checkip.dyndns.org" Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "datd373.tm" Pattern match: "api.telegram.org/bot" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "PATHEXT=.COM" Heuristic match: "api.ipify.org" Heuristic match: "checkip.amazonaws.com" Heuristic match: "checkip.dyndns.com" Heuristic match: "checkip.org" Heuristic match: "checkmyip.com" Heuristic match: "cmyip.com" Heuristic match: "curlmyip.com" Heuristic match: "findmyip.org" Heuristic match: "formyip.com" Heuristic match: "geoip.co.uk" Heuristic match: "geoiptool.com" Heuristic match: "getmyip.co.uk" Heuristic match: "getmyip.org" Heuristic match: "icanhazip.com" Heuristic match: "ifconfig.me" Heuristic match: "ip-addr.es" Heuristic match: "ip-address.domaintools.com" Heuristic match: "ip-api.com" Heuristic match: "ip-score.com" Heuristic match: "ip.jsontest.com" Heuristic match: "ip.xss.ru" Heuristic match: "ip4.telize.com" Heuristic match: "ipchicken.com" Heuristic match: "ipecho.net" Heuristic match: "ipinfo.info" Heuristic match: "ipinfo.io" Heuristic match: "ipleak.net" Heuristic match: "ipligence.com" Heuristic match: "knowmyip.com" Heuristic match: "maxmind.com" Heuristic match: "meineipadresse.de" Heuristic match: "myexternalip.com" Heuristic match: "myip.dnsomatic.com" Heuristic match: "myip.ht" Heuristic match: "myip.nl" Heuristic match: "myip.opendns.com" Heuristic match: "myipaddress.com" Heuristic match: "queryip.net" Heuristic match: "showmyip.com" Heuristic match: "showmyipaddress.com" Heuristic match: "tracemyip.org" Heuristic match: "whatismyip.akamai.com" Heuristic match: "whatismyip.ca" Heuristic match: "whatismyip.com" Heuristic match: "whatismyip.everdot.org" Heuristic match: "whatismyipaddress.com" Heuristic match: "whatsmyip.net" Heuristic match: "whatsmyip.org" Heuristic match: "whatsmyipaddress.org" Heuristic match: "whatsmypublicip.com" Heuristic match: "wtfismyip.com" Heuristic match: "hispeed.ch" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "awing.ni" Pattern match: "http://checkip.dyndns.org/" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/" Pattern match: "http://checkip.dyndns.org" Pattern match: "http://checkip.dyndns.com" Heuristic match: "heckip.dyndns.org" Heuristic match: "Host: checkip.dyndns.org" Pattern match: "http://www.w3.org/2001/XMLSchema" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "heckip.dyndns.com" Heuristic match: "ip.dyndns.com" Heuristic match: "ip.dyndns.org"3f:T459,"ttps://api.telegram.org/bot" (Indicator: "api.telegram.org"; Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") "ttps://api.telegram.org/bot" (Indicator: "api.telegram.org"; Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp")40:T94a,Observed string:"OpenClipboard" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin] Observed string:"OpenClipboard" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp] Observed string:"GetClipboardData" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"OpenClipboard" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"GetClipboardData" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp] Observed string:"OpenClipboard" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]41:T425,Observed string:"GetProcessesByName" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"GetProcessesByName" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]42:T73a,Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp43:Taee,Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "GetTempFileNameW" (Indicator: "GetTempFileName") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp44:T83e,Observed string:"GetKeyboardState" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"MapVirtualKey" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"GetKeyboardState" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp] Observed string:"MapVirtualKey" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]45:T8d4,Observed string:"GetModuleFileName" [Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp] Observed string:"GetModuleFileName" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin] Observed string:"GetModuleFileName" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp] Observed string:"GetModuleFileName" [Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp] Observed string:"GetModuleFileName" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"GetModuleFileName" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp] Observed string:"GetModuleFileName" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp] Observed string:"GetModuleFileName" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]46:T42d,Observed string:"GetEnvironmentVariable" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"GetEnvironmentVariable" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]47:T1a44,"oftware\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp "oftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp "oftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\PostboxApp\Profiles'.\Pale Moon\Profiles'." in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\*" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles'." in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\PostboxApp\Profiles" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\PostboxApp\Profiles\*" in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp48:T1086,Observed string:"SetWindowsHookExA" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"CallNextHook" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"UnhookWindowsHookEx" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"CallNextHookEx" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp] Observed string:"SetWindowsHookExA" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp] Observed string:"CallNextHook" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp] Observed string:"UnhookWindowsHookEx" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp] Observed string:"CallNextHookEx" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp]49:Tf48,Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.00408000.00000002.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp 00000000-00003576.00000001.66567.0040A000.00000004.mdmp Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp 00000000-00003720.00000001.66552.00370000.00000004.mdmp 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp Observed string: "CorExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.006C0000.00000004.mdmp 00000000-00003864.00000000.66692.007D0000.00000040.mdmp 00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000000.66692.03390000.00000004.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.006C0000.00000004.mdmp 00000000-00003864.00000001.68611.007D0000.00000040.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.03390000.00000004.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.006C0000.00000004.mdmp 00000000-00003864.00000002.70532.007D0000.00000040.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.03390000.00000004.mdmp Observed string: "TerminateProcess" (Indicator: "TerminateProcess") in Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp 00000000-00003864.00000001.68611.00400000.00000040.mdmp 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp 00000000-00003864.00000002.70532.00400000.00000040.mdmp 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp4a:T297d,Found string "FromBase64String" (Indicator: "base64"; in Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") Found string "FromBase64String" (Indicator: "frombase64string"; in Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; in Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; in Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; in Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; in Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "system.security.cryptography"; in Source: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; in Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp") Found string "FromBase64String" (Indicator: "frombase64string"; in Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; in Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; in Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; in Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; in Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "system.security.cryptography"; in Source: "00000000-00003864.00000000.66692.00400000.00000040.mdmp, 00000000-00003864.00000000.66692.006C0000.00000004.mdmp, 00000000-00003864.00000000.66692.007D0000.00000040.mdmp, 00000000-00003864.00000000.66692.00820000.00000004.mdmp, 00000000-00003864.00000000.66692.03390000.00000004.mdmp, 00000000-00003864.00000001.68611.00400000.00000040.mdmp, 00000000-00003864.00000001.68611.006C0000.00000004.mdmp, 00000000-00003864.00000001.68611.007D0000.00000040.mdmp, 00000000-00003864.00000001.68611.00820000.00000004.mdmp, 00000000-00003864.00000001.68611.03390000.00000004.mdmp, 00000000-00003864.00000002.70532.00400000.00000040.mdmp, 00000000-00003864.00000002.70532.006C0000.00000004.mdmp, 00000000-00003864.00000002.70532.007D0000.00000040.mdmp, 00000000-00003864.00000002.70532.00820000.00000004.mdmp, 00000000-00003864.00000002.70532.03390000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "rsacryptoserviceprovider"; in Source: "00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp"), Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "rsacryptoserviceprovider"; in Source: "00000000-00003864.00000000.66692.00820000.00000004.mdmp 00000000-00003864.00000001.68611.00820000.00000004.mdmp 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.00820000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp"), Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "system.security.cryptography"; in Source: "00000000-00003864.00000000.66692.02390000.00000004.mdmp 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp"), Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "system.security.cryptography"; in Source: "00000000-00003864.00000000.66692.02390000.00000004.mdmp 00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp"), Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "system.security.cryptography"; in Source: "00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp"), Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "rsacryptoserviceprovider"; in Source: "00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp"), Found string "System.Security.Cryptography.SHA1" (Indicator: "system.security.cryptography"; in Source: "00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp"), Found string "System.Security.Cryptography.AesCryptoServiceProvider System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; in Source: "00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp"), Found string "System.Security.Cryptography.AesCryptoServiceProvider System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" (Indicator: "system.security.cryptography"; in Source: "00000000-00003864.00000001.68611.02390000.00000004.mdmp 00000000-00003864.00000002.70532.02390000.00000004.mdmp")4b:Tb56,"79.25.65.61" Potential IP "1.0.0.0" found in string "Microsoft.Windows.IsolationAutomation,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="1.0.0.0"C:\Windows\WinSxS\manifests\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest" Potential IP "1.0.0.0" found in string "Nullsoft.NSIS.exehead,processorArchitecture="*",type="win32",version="1.0.0.0"C:\FEDEX-2716436747964836.exe" Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32,processorArchitecture="x86",type="win32",version="5.1.0.0"C:\Windows\syswow64\SHELL32.dll" Potential IP "5.1.0.0" found in string "Microsoft.Windows.Shell.shell32,processorArchitecture="*",type="win32",version="5.1.0.0"C:\Windows\WindowsShell.Manifest" "1.0.0.0" "11.0.0.0" "17.0.0.0" "17.0.3.0" Potential IP "1.0.0.0" found in string "" Potential IP "6.0.0.0" found in string "version="6.0.0.0"" "4.0.0.0" Potential IP "4.0.0.0" found in string "System.Core,4.0.0.0,,b77a5c561934e" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=" Potential IP "4.0.0.0" found in string "em.Runtime.Remoting,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="MachineToApplication" />", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="MachineToApplication" />" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowLocation="false" />" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" "8.8.8.8" "255.255.255.255" Potential IP "67.218.111.202" found in string "Current IP CheckCurrent IP Address: 67.218.111.202" Potential IP "67.218.111.202" found in string "le>Current IP CheckCurrent IP Address: 67.218.111.202" Potential IP "67.218.111.202" found in string "Current IP Address: 67.218.111.202" Potential IP "67.218.111.202" found in string "Current IP Address: 67.218.111.202" "67.218.111.202" Potential IP "67.218.111.202" found in string "Client IP: 67.218.111.202" Potential IP "4.0.0.0" found in string "Public member '{0}' on type '{1}' not found.ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"4c:T1649,"checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "PCAP") "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" (Indicator: "checkip.dyndns.org"; File: "PCAP") "ttp://checkip.dyndns.org/" (Indicator: "checkip.dyndns.org"; File: "00000000-00003720.00000000.66498.00370000.00000004.mdmp, 00000000-00003720.00000001.66552.00370000.00000004.mdmp") "api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "checkip.amazonaws.com" (Indicator: "checkip.amazonaws.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "checkip.dyndns.com" (Indicator: "checkip.dyndns.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "checkip.org" (Indicator: "checkip.org"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "checkmyip.com" (Indicator: "checkmyip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "cmyip.com" (Indicator: "cmyip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "curlmyip.com" (Indicator: "curlmyip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "findmyip.org" (Indicator: "findmyip.org"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "formyip.com" (Indicator: "formyip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "geoip.co.uk" (Indicator: "geoip.co.uk"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "geoiptool.com" (Indicator: "geoiptool.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "getmyip.co.uk" (Indicator: "getmyip.co.uk"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "getmyip.org" (Indicator: "getmyip.org"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "icanhazip.com" (Indicator: "icanhazip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ifconfig.me" (Indicator: "ifconfig.me"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ip-addr.es" (Indicator: "ip-addr.es"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ip-address.domaintools.com" (Indicator: "ip-address.domaintools.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ip-api.com" (Indicator: "ip-api.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ip-score.com" (Indicator: "ip-score.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ip.jsontest.com" (Indicator: "ip.jsontest.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ip.xss.ru" (Indicator: "ip.xss.ru"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ip4.telize.com" (Indicator: "ip4.telize.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ipchicken.com" (Indicator: "ipchicken.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ipecho.net" (Indicator: "ipecho.net"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ipinfo.info" (Indicator: "ipinfo.info"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ipleak.net" (Indicator: "ipleak.net"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "ipligence.com" (Indicator: "ipligence.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "knowmyip.com" (Indicator: "knowmyip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "maxmind.com" (Indicator: "maxmind.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "meineipadresse.de" (Indicator: "meineipadresse.de"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "myexternalip.com" (Indicator: "myexternalip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "myip.dnsomatic.com" (Indicator: "myip.dnsomatic.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "myip.ht" (Indicator: "myip.ht"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "myip.nl" (Indicator: "myip.nl"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "myip.opendns.com" (Indicator: "myip.opendns.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "myipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "queryip.net" (Indicator: "queryip.net"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "showmyip.com" (Indicator: "showmyip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "showmyipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "tracemyip.org" (Indicator: "tracemyip.org"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "whatismyip.akamai.com" (Indicator: "whatismyip.akamai.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "whatismyip.ca" (Indicator: "whatismyip.ca"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "whatismyip.com" (Indicator: "whatismyip.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "whatismyip.everdot.org" (Indicator: "whatismyip.everdot.org"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp") "whatismyipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00003720.00000001.66552.02500000.00000004.mdmp")4d:Te7c,"nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "IMAP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "POP3 PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "HTTP PASSWORD") "nkqpbn.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "SMTP PASSWORD")4e:Ta6a,"nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XPOM\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "nkqpbn.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA_I18N\DEFAULT\UC LOGIN DATA.18"4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790924731259,"unified_at":"2026-10-02T07:05:31.259Z","metadata":{"hashes":{"sha256":"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6","sha1":"38aeb36b3f31aa8f4c08ecfd6b7c695297535160","md5":"7ec2931770c7f4965a1428a637c20ac5","sha512":"111354033005174ff0fb1490c057be9a4dd7a8367da75f75a792dd50e534580b6d4a09260419b196ca5b563c5faf2ad88dd3a9410e761149eb5faba7bad9c497","ssdeep":"6144:PYa6tVqxrPTiFxabi2tSRljOwqtrr8Y6+20eatd3X8jFDgFIi8:PYXVqxLUkbSjOTp6+20z8jFM+h","ssdeep_chunks":["6144:PYa6tVq","6144:Ya6tVqx","6144:a6tVqxr","6144:6tVqxrP","6144:tVqxrPT","6144:VqxrPTi","6144:qxrPTiF","6144:xrPTiFx","6144:rPTiFxa","6144:PTiFxab","6144:TiFxabi","6144:iFxabi2","6144:Fxabi2t","6144:xabi2tS","6144:abi2tSR","6144:bi2tSRl","6144:i2tSRlj","6144:2tSRljO","6144:tSRljOw","6144:SRljOwq","6144:RljOwqt","6144:ljOwqtr","6144:jOwqtrr","6144:Owqtrr8","6144:wqtrr8Y","6144:qtrr8Y6","6144:trr8Y6+","6144:rr8Y6+2","6144:r8Y6+20","6144:8Y6+20e","6144:Y6+20ea","6144:6+20eat","6144:+20eatd","6144:20eatd3","6144:0eatd3X","6144:eatd3X8","6144:atd3X8j","6144:td3X8jF","6144:d3X8jFD","6144:3X8jFDg","6144:X8jFDgF","6144:8jFDgFI","6144:jFDgFIi","6144:FDgFIi8","12288:PYa6tVq","12288:Ya6tVqx","12288:a6tVqxr","12288:6tVqxrP","12288:tVqxrPT","12288:VqxrPTi","12288:qxrPTiF","12288:xrPTiFx","12288:rPTiFxa","12288:PTiFxab","12288:TiFxabi","12288:iFxabi2","12288:Fxabi2t","12288:xabi2tS","12288:abi2tSR","12288:bi2tSRl","12288:i2tSRlj","12288:2tSRljO","12288:tSRljOw","12288:SRljOwq","12288:RljOwqt","12288:ljOwqtr","12288:jOwqtrr","12288:Owqtrr8","12288:wqtrr8Y","12288:qtrr8Y6","12288:trr8Y6+","12288:rr8Y6+2","12288:r8Y6+20","12288:8Y6+20e","12288:Y6+20ea","12288:6+20eat","12288:+20eatd","12288:20eatd3","12288:0eatd3X","12288:eatd3X8","12288:atd3X8j","12288:td3X8jF","12288:d3X8jFD","12288:3X8jFDg","12288:X8jFDgF","12288:8jFDgFI","12288:jFDgFIi","12288:FDgFIi8","6144:PYXVqxL","6144:YXVqxLU","6144:XVqxLUk","6144:VqxLUkb","6144:qxLUkbS","6144:xLUkbSj","6144:LUkbSjO","6144:UkbSjOT","6144:kbSjOTp","6144:bSjOTp6","6144:SjOTp6+","6144:jOTp6+2","6144:OTp6+20","6144:Tp6+20z","6144:p6+20z8","6144:6+20z8j","6144:+20z8jF","6144:20z8jFM","6144:0z8jFM+","6144:z8jFM+h"],"imphash":"61259b55b8912888e90f516ca08dc514"},"file_info":{"file_name":"FEDEX - 2716436747964836.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":262372,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678920522000,"last_seen":1678920603000,"last_multi_scan":1678920603000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["tnega"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":55},"sandbox_signatures":{"informative_count":111,"suspicious_count":20,"malicious_count":12,"total":143},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.bf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FTRG!7EC2931770C7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains reference to Windows native API (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to create files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to update the user profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify the virtual address space of a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Found debugger evasion api strings"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify/delete registry keys (API string)"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"suspicious","value":"Reads configuration files"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve local/system time as file time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"suspicious","value":"Tries to steal Pidgin account information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Exfiltration","technique":"Exfiltration to Cloud Storage","attack_id":"T1567.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1567/002","identifiers":[{"type":"informative","value":"Found strings related to cloud services domains (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProcW\" (Indicator: \"CallWindowProc\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"CallWindowProcW\" (Indicator: \"CallWindowProc\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed string:\"SetUnhandledExceptionFilter\" [Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]\n Observed string:\"UnhandledExceptionFilter\" [Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003720-29289-229-00F79D4C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003720-29289-17-00F764EA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003720-29289-360-00F75BF4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003720-29289-16-00F7450E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"IsDebuggerPresent\" [Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-238","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Observed string: \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\") in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp\n 00000000-00003864.00000002.70532.02390000.00000004.mdmp\n Observed string: \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\") in Source: 00000000-00003864.00000001.68611.02390000.00000004.mdmp\n 00000000-00003864.00000002.70532.02390000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003576-23021-45-00403479\n GetTickCount@KERNEL32.DLL at 00000000-00003576-23021-43-00406187\n GetTickCount@KERNEL32.DLL at 00000000-00003576-23021-74-004030D0\n GetTickCount@KERNEL32.DLL at 00000000-00003576-23021-46-0040302E\n GetTickCount@KERNEL32.DLL at 00000000-00003720-29289-206-00F76278","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.DLL at 00000000-00003576-23021-39-00401434\n FindFirstFileW@KERNEL32.DLL at 00000000-00003576-23021-24-00405D74\n FindFirstFileW@KERNEL32.DLL at 00000000-00003576-23021-30-0040699E\n FindFirstFileW@KERNEL32.DLL at 00000000-00003576-25118-24-00405D74","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003720-29289-206-00F76278","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003720-29289-206-00F76278","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Observed string:\"GetLocaleInfoA\" [Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp\n 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp\n 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp\n 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp\n 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00003720-29289-128-00F79E63","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00003576-23021-91-00404AB5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string:\"GetDiskFreeSpaceExW\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"GetDiskFreeSpaceW\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"GetDiskFreeSpaceW\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]\n Observed string:\"GetDiskFreeSpaceExW\" [Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp\n 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"FEDEX-2716436747964836.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"FEDEX-2716436747964836.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"nkqpbn.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"nkqpbn.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local/system time as file time (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Observed string: \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetUserDefaultUILanguage\"[Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed api: \"GetUserDefaultUILanguage\"[Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp\n 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"GetVersionExW \" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"GetVersionExW \" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-0000013Ch], 0Ah\" and \"jnc 004036DBh\" at 00000000-00003576-23021-1-00403640\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-0000013Ch], 0Ah\" and \"jnc 004036DBh\" at 00000000-00003576-25118-1-00403640","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00003720-29289-139-00F7A330","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"nkqpbn.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Web.Extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\System.Web.Extensions.dll\" at 00000000-00003864-00000046-11310082196227134\n \"nkqpbn.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Web.Extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\System.Web.Extensions.dll\" at 00000000-00003864-00000046-11310082196235587","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"FEDEX-2716436747964836.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nkqpbn.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"nkqpbn.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"158.101.44.242:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Observed string: \"CreateProcessW\" (Indicator: \"CreateProcess\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"CreateProcessW\" (Indicator: \"CreateProcess\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003576-23021-39-00401434\n Sleep@KERNEL32.DLL at 00000000-00003720-29289-52-00F7640B\n Sleep@KERNEL32.DLL at 00000000-00003720-29289-10-00F72F7C\n Sleep@KERNEL32.DLL at 00000000-00003720-29289-178-00F7649C\n Sleep@KERNEL32.DLL at 00000000-00003720-29289-36-00F76450","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: nkqpbn.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00003576-23021-39-00401434\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003576-23021-23-004069C5\n LoadLibraryA@KERNEL32.DLL at 00000000-00003720-29289-13-00F76A26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed API string: \"CreateThread\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$36","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"Observed string:\"CloseHandle\" that closes an open object handle. [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"CreateFileA\" that creates/opens a file or I/O device. [Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]\n Observed string:\"CreateFileW\" that creates/opens a file or I/O device. [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"lstrcatW\" that appends one string to another. [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"ReadFile\" that reads data from a file or I/O device. [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Observed string: \"SHFileOperationW\" (Indicator: \"SHFileOperation\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"SHFileOperationW\" (Indicator: \"SHFileOperation\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Active Setup\\Installed Components\" in Source: 00000000-00003576.00000001.66567.0040A000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"$37","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\" (Indicator: \"mozilla/4.0 (\")\" in Source: 00000000-00003864.00000000.66692.02390000.00000004.mdmp\n 00000000-00003864.00000001.68611.02390000.00000004.mdmp\n 00000000-00003864.00000002.70532.02390000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"FEDEX-2716436747964836.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72E40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"nkqpbn.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71030000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"nkqpbn.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72510000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"FEDEX-2716436747964836.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F80000\n \"nkqpbn.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002c7af7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"0e000f00a47af7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"0e000f00d87af7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"11001200387ff7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"11001200a47ff7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"12001300b87ff7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"12001300e07ff7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"14001500bc93f7721cfb2f0054b4f572@ADVAPI32.dll\"\n \"0d000e000080f7721cfb2f0054b4f572@SHELL32.dll\"\n \"0d000e005480f7721cfb2f0054b4f572@SHELL32.dll\"\n \"1b001c0060f0f172d0fb2f008d8cf072@api-ms-win-core-synch-l1-2-0.DLL\"\n \"150016002c7af7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"0e000f00a47af7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"0e000f00d87af7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"11001200387ff7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"11001200a47ff7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"12001300b87ff7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"12001300e07ff7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"14001500bc93f7722cfb2f0054b4f572@ADVAPI32.dll\"\n \"0d000e000080f7722cfb2f0054b4f572@SHELL32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"FEDEX-2716436747964836.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"FEDEX-2716436747964836.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\" has an executable section named \".text\"\n \"nkqpbn.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\" has an writable section named \".data\"\n \"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\" has an writable section named \".ndata\"\n \"nkqpbn.exe\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$39","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"nkqpbn.exe\" (UID: 00000000-00003720) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"nkqpbn.exe\" (UID: 00000000-00003720) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"nkqpbn.exe\" with commandline \"%TEMP%\\\\zrfsjy.gui\" (UID: 00000000-00003720)\n Spawned process \"nkqpbn.exe\" (UID: 00000000-00003864)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"nkqpbn.exe\" with commandline \"%TEMP%\\\\zrfsjy.gui\" (UID: 00000000-00003720)\n Spawned process \"nkqpbn.exe\" (UID: 00000000-00003864)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 235906)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"FEDEX-2716436747964836.exe\" connecting to \"\\ThemeApiPort\"\n \"nkqpbn.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"nkqpbn.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nkqpbn.exe]- [targetUID: 00000000-00003720]\n \"kyqxwbxje.vza\" has type \"data\"- Location: [%TEMP%\\kyqxwbxje.vza]- [targetUID: 00000000-00003720]\n \"nsvC636.tmp\" has type \"data\"- Location: [%TEMP%\\nsvC636.tmp]- [targetUID: 00000000-00003576]\n \"zrfsjy.gui\" has type \"data\"- Location: [%TEMP%\\zrfsjy.gui]- [targetUID: 00000000-00003720]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"FEDEX-2716436747964836.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"FEDEX-2716436747964836.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"FEDEX-2716436747964836.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"nkqpbn.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"nkqpbn.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"nkqpbn.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"nkqpbn.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"nkqpbn.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"nkqpbn.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"datqlmx.tmp\" [Source: 00000000-00003576.00000000.66377.008EF000.00000004.mdmp\n 00000000-00003576.00000001.66567.008EF000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Network Related","name":"Found strings related to cloud services domains (possible C&C communication)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1567.002","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"nkqpbn.exe\"\n YARA signature for RC4 encryption matched on process \"00000000-00003576\"\n YARA signature for RC4 encryption matched on process \"00000000-00003720\"\n YARA signature for RC4 encryption matched on process \"00000000-00003864\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on file \"nsvC636.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string:\"SystemParametersInfoW\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"SystemParametersInfoW\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string:\"FindFirstFileW\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"FindNextFileW\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"FindFirstFileW\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]\n Observed string:\"FindNextFileW\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]\n Observed string:\"FindNextFileW\" [Source: 00000000-00003720.00000000.66498.00370000.00000004.mdmp\n 00000000-00003720.00000001.66552.00370000.00000004.mdmp]\n Observed string:\"FindNextFileW\" [Source: 00000000-00003864.00000000.66692.00400000.00000040.mdmp\n 00000000-00003864.00000001.68611.00400000.00000040.mdmp\n 00000000-00003864.00000002.70532.00400000.00000040.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"Observed string: \"RegEnumKeyW\" (Indicator: \"RegEnumKey\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"RegQueryValueExW\" (Indicator: \"RegQueryValue\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"RegEnumKeyW\" (Indicator: \"RegEnumKey\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp\n Observed string: \"RegQueryValueExW\" (Indicator: \"RegQueryValue\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp\n Observed string: \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string:\"ExpandEnvironmentStringsW\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"ExpandEnvironmentStringsW\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string:\"GetSystemMetrics\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"GetSystemMetrics\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000000.66377.0040A000.00000004.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.0040A000.00000004.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00003720.00000000.66498.00F7C000.00000002.mdmp\n 00000000-00003720.00000001.66552.00F7C000.00000002.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00003864.00000000.66692.00F7C000.00000002.mdmp\n 00000000-00003864.00000001.68611.00F7C000.00000002.mdmp\n 00000000-00003864.00000002.70532.00F7C000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$47","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: nkqpbn.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1056.004","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string:\"AdjustTokenPrivileges\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"SeShutdownPrivilege\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"AdjustTokenPrivileges\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]\n Observed string:\"SeShutdownPrivilege\" [Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp\n 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]\n Observed string:\"SeDebugPrivilege\" [Source: 00000000-00003864.00000000.66692.00820000.00000004.mdmp\n 00000000-00003864.00000000.66692.02390000.00000004.mdmp\n 00000000-00003864.00000001.68611.02390000.00000004.mdmp\n 00000000-00003864.00000002.70532.02390000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed string:\"SetFileSecurityW\" which can Sets the security of a file or directory object. [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"SetFileSecurityW\" which can Sets the security of a file or directory object. [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"nkqpbn.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"FEDEX-2716436747964836.exe\" opened \"\\Device\\KsecDD\"\n \"nkqpbn.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to modify/delete registry keys (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string:\"ExitWindowsEx\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"InitiateShutdownW\" [Source: af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6.bin]\n Observed string:\"ExitWindowsEx\" [Source: 00000000-00003576.00000000.66377.00408000.00000002.mdmp\n 00000000-00003576.00000001.66567.00408000.00000002.mdmp]\n Observed string:\"InitiateShutdownW\" [Source: 00000000-00003576.00000000.66377.0040A000.00000004.mdmp\n 00000000-00003576.00000001.66567.0040A000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"nkqpbn.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nkqpbn.exe]- [targetUID: 00000000-00003720]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"nkqpbn.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"nkqpbn.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 63715-336-00402084","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00003576-23021-39-00401434\n GetModuleHandleA@KERNEL32.DLL at 00000000-00003576-23021-22-00406A35\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003720-29289-10-00F72F7C\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003720-29289-193-00F74372\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003720-29289-32-00F740C9\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003720-29289-56-00F72FD5\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003720-29289-9-00F73FDD\n GetModuleHandleW@KERNEL32.DLL at 00000000-00003720-29289-14-00F73F62","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.DLL at 00000000-00003720-29289-190-00F7567A\n GetStartupInfoA@KERNEL32.DLL at 00000000-00003720-29289-1-00F71EBE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00003576-23021-101-00405809","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to steal Pidgin account information (file access)","description":"\"nkqpbn.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\.PURPLE\\ACCOUNTS.XML\"\n \"nkqpbn.exe\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-116","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"FEDEX-2716436747964836.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"nkqpbn.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nkqpbn.exe]- [targetUID: 00000000-00003720]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"FEDEX-2716436747964836.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4b","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 158.101.44.242 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00003576-23021-69-00403D17","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"zrfsjy.gui\" which has been seen in the context of ransomware (Indicator: .gui)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"FEDEX-2716436747964836.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsfC625.tmp\" for deletion\n \"FEDEX-2716436747964836.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsaC6A4.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"FEDEX-2716436747964836.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsfC625.tmp\" with delete access\n \"FEDEX-2716436747964836.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsaC6A4.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetVersionExW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n GetSystemDirectoryW\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteExW\n FindWindowExW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n VirtualProtect\n GetCommandLineA\n GetStartupInfoA\n TerminateProcess\n CreateFileA\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"FEDEX-2716436747964836.exe\" wrote bytes \"7111dc007a3bdb00ab8b02007f950200fc8c0200729602006cc805001ecdd8007d26d800\" to virtual address \"0x762F07E4\" (part of module \"USER32.DLL\")\n \"FEDEX-2716436747964836.exe\" wrote bytes \"d055f5746473fe740000000051c1107694981076ee9c107675dc1276273e12760fb316760000000085485576698755760f775776d9175576ead75676a9345576f8115576201455764cbc5776f516557654145576ff1055763214557600000000\" to virtual address \"0x72EE1000\" (part of module \"SHFOLDER.DLL\")\n \"nkqpbn.exe\" wrote bytes \"7111dc007a3bdb00ab8b02007f950200fc8c0200729602006cc805001ecdd8007d26d800\" to virtual address \"0x762F07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"FEDEX-2716436747964836.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 412)\n \"FEDEX-2716436747964836.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 412)\n \"FEDEX-2716436747964836.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 412)\n \"FEDEX-2716436747964836.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 412)\n \"nkqpbn.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 244)\n \"nkqpbn.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 244)\n \"nkqpbn.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 244)\n \"nkqpbn.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nkqpbn.exe\" (Handle: 244)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Malware.Formbook","description":"YARA signature Malware.Formbook matched on process \"00000000-00003720\"","origin":"YARA Signature","relevance":10,"id":"yara-21","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - SnakeKeylogger","description":"YARA signature Malware.SnakeKeylogger matched on process \"00000000-00003864\"\n YARA signature Malware.SnakeKeylogger matched on process \"00000000-00003720\"","origin":"YARA Signature","relevance":10,"id":"yara-5","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - TelegramRAT","description":"YARA signature Malware.TelegramRAT matched on process \"00000000-00003864\"\n YARA signature Malware.TelegramRAT matched on process \"00000000-00003720\"","origin":"YARA Signature","relevance":10,"id":"yara-7","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$4e","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"nkqpbn.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"nkqpbn.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00003576-23021-1-00403640\n ExitWindowsEx@USER32.DLL at 00000000-00003576-25118-1-00403640","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00003576-23021-78-00401000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"Spyware","details_count":5,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Tries to steal desktop applications information (file access)"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the windows installation language"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":88,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["tnega"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64124b3c17c16f1de00b7a4d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"FEDEX - 2716436747964836.exe","analysis_start_time":"2023-03-15T22:48:29+00:00","indicators_count":{"informative":111,"suspicious":46,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"158.101.44.242","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}],"dns_resolutions":[{"domain":"checkip.dyndns.org","address":"158.101.44.242","ttl":218,"country":"United States","registrar_name":"Tucows Inc.","registrar_organization":"Dynamic Network Services, Inc.","registrar_name_servers":"NS2.DYNDNS.ORG","registrar_creation_date":"1998-11-22T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"158.101.44.242:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}],"processes":[{"pid":3576,"ppid":0,"name":"FEDEX-2716436747964836.exe","command_line":"","sha256":"af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6","normalized_path":"C:\\FEDEX-2716436747964836.exe","uid":"00000000-00003576","icon":"$4f"},{"pid":3720,"ppid":3576,"name":"nkqpbn.exe","command_line":"%TEMP%\\zrfsjy.gui","sha256":"d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df","normalized_path":"%TEMP%\\nkqpbn.exe","parent_uid":"00000000-00003576","uid":"00000000-00003720"},{"pid":3864,"ppid":3720,"name":"nkqpbn.exe","command_line":"","sha256":"d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df","normalized_path":"%TEMP%\\nkqpbn.exe","parent_uid":"00000000-00003720","uid":"00000000-00003864"}],"all_imported_dlls":["ws2_32.dll","apphelp.dll","msacm32.dll","vcruntime140_clr0400.dll","nlssorting.dll","rasapi32.dll","kernel32.dll","msvcrt.dll","userenv.dll","cfgmgr32.dll","version.dll","tzres.dll","clrjit.dll","rsaenh.dll","sechost.dll","nsi.dll","winhttp.dll","propsys.dll","Wldap32.dll","ole32.dll","pdh.dll","mscoreei.dll","bcrypt.dll","WSHTCPIP.DLL","credssp.dll","wow64win.dll","setupapi.dll","oleaut32.dll","System.ni.dll","cryptsp.dll","IPHLPAPI.DLL","psapi.dll","user32.dll","rpcrt4.dll","msctf.dll","ntmarta.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","dhcpcsvc.dll","clr.dll","wow64cpu.dll","shlwapi.dll","gdi32.dll","profapi.dll","oleaccrc.dll","KernelBase.dll","mscorlib.ni.dll","Microsoft.VisualBasic.ni.dll","dwmapi.dll","devobj.dll","fltLib.dll","shfolder.dll","winmm.dll","mswsock.dll","dhcpcsvc6.dll","comctl32.dll","ucrtbase_clr0400.dll","cryptbase.dll","imm32.dll","msvfw32.dll","FWPUCLNT.DLL","System.Configuration.ni.dll","rasadhlp.dll","wow64.dll","mscoree.dll","System.Drawing.ni.dll","wship6.dll","ntdll.dll","avifil32.dll","loadperf.dll","dnsapi.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Web.Extensions.dll","advapi32.dll","sspicli.dll","shell32.dll","rtutils.dll","System.Xml.ni.dll","webio.dll","uxtheme.dll","oleacc.dll","winnsi.dll","lpk.dll","clbcatq.dll","riched20.dll","System.Core.ni.dll","rasman.dll","System.Windows.Forms.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"zrfsjy.gui","sha256":"75c13ba71fee1af4cd25d6fba59ae70e474311944e4f1aa2c4908946642a17d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"kyqxwbxje.vza","sha256":"67154cccc4aad51b2f759b3942942d848856940737f93bf2d7c586c61503cbe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"nkqpbn.exe","sha256":"d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"nsvC636.tmp","sha256":"4d80ced8e5f009a47d702c9931488c21d9fd0728a2e960f8cfac59686acbb4fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"%TEMP%\\nsvC636.tmp","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"64124b3c17c16f1de00b7a4d"}]}]}},"report_ids":{"sandbox_job_ids":["64124b3c17c16f1de00b7a4d"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample af4962cafb50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample af4962cafb50…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 4/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample af4962cafb50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample af4962cafb50…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 4/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample af4962cafb50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample af4962cafb50…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 4/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L50","11",{}]]